rsync contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker supplies a specially crafted path which causes the sanitize_path()function to generate an absolute filename in place of a relative filename, which will disclose arbitrary file information resulting in a loss of confidentiality.

Currently, there are no known workarounds or upgrades to correct this issue. However, rsync has released a patch to address this vulnerability.

• Secunia Advisory ID: 12294 12307 12310 12312 12313 12315 12335 12433 12797 13048
• CVE ID: 2004-0792 (see also: NVD)
• Other Advisory URL: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000881
  http://rhn.redhat.com/errata/RHSA-2004-436.html
  http://secwatch.org/advisories/1008415
  http://www.debian.org/security/2004/dsa-538
  http://www.mandriva.com/security/advisories?name=MDKSA-2004:083
  http://www.novell.com/linux/security/advisories/2004_26_rsync.html
  http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.431578
  http://www.suse.de/de/security/2004_26_rsync.html
  http://www.trustix.net/errata/2004/0042/
• Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=109268147522290&w=2
  http://marc.theaimsgroup.com/?l=bugtraq&m=109277141223839&w=2
• Vendor URL: http://rsync.samba.org/
• Vendor Specific Advisory URL: http://rsync.samba.org/#security_aug04
  http://security.gentoo.org/glsa/glsa-200408-17.xml
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:083
• Vendor Specific News/Changelog Entry: http://samba.org/rsync/#security_aug04

Unknown or Incomplete