A critical security update for the widely-used file-syncing tool Rsync has been released in version 3.4.0, addressing six major vulnerabilities that could allow remote code execution and unsafe file manipulation. These vulnerabilities, identified by researchers from Google Cloud, include a heap buffer overflow, information leaks, path traversal, and race conditions.
The most critical of these flaws, assigned CVE-2024-12084, involves a heap buffer overflow that could allow attackers with anonymous read access to execute arbitrary code. Additionally, the vulnerabilities lead to issues such as arbitrary file read, creation of unsafe symbolic links, and data exposure.
Canonical has released updates for Rsync across all supported Ubuntu versions to mitigate these security risks. Users are strongly advised to install these updates immediately. To verify if the patch has been applied, users should check the installed version of Rsync using the <code>dpkg</code> command and update if necessary.
For those unable to update immediately, mitigations include disabling SHA support and using proper compilation flags. The new version, Rsync 3.4.0, and a subsequent minor bug-fix update 3.4.1, incorporate these security fixes to protect against potential exploits.
Administrators, especially those managing critical systems like Arch Linux mirrors, are urged to upgrade their Rsync daemons and clients to the latest version to safeguard against these vulnerabilities. Users should also monitor software vendor advisories for further updates and apply them promptly to ensure continued security.

Collections

Rsync version 3.4.0 has been released, addressing six critical security vulnerabilities, including a heap buffer overflow that could lead to remote code execution. Users, especially those managing critical systems, are urged to update immediately to mitigate risks. For immediate security, mitigations such as disabling SHA support are recommended. Canonical has released updates for all supported Ubuntu versions, and users should verify their Rsync version and apply necessary updates.

Rsync 3.4 Released to Fix Multiple Security Vulnerabilities