Over 660k Rsync servers exposed to code execution attacks
bleepingcomputer.com
Over 660k Rsync servers exposed to code execution attacks
1–6 of 6 posts
Re: Over 660k Rsync servers exposed to code execution attacks
#2was surprised seeing this not discussed previously, as it can have rather big ramifications also for home server holsters etc (if not behind VPN)
Re: Over 660k Rsync servers exposed to code execution attacks
#3There's something I am missing here. I sync my servers with rsync, but it is over ssh - is this still vulnerable?
Re: Over 660k Rsync servers exposed to code execution attacks
#4Re: Over 660k Rsync servers exposed to code execution attacks
#5There's something I am missing here. I sync my servers with rsync, but it is over ssh - is this still vulnerable?
If you explicitly use "-e ssh" and don't run a daemon, then these probably don't affect you.
If you don't specify that protocol, though, you have three scenarios:
1. only the local host has the rsync binary 2. both local and remote hosts have the binary, but neither runs them as a daemon 3. both have the binary and the remote runs as the daemon
In #1 you end up using SSH anyway (unless there's also no SSH binary). In #2, a malicious server binary could attack you. In #3, a malicious server binary could attack you.
Also, many of rsync's features rely upon both sides having the binary.
Re: Over 660k Rsync servers exposed to code execution attacks
#6There's something I am missing here. I sync my servers with rsync, but it is over ssh - is this still vulnerable?
If you explicitly use "-e ssh" and don't run a daemon, then these probably don't affect you. If you don't specify that protocol, though, you have three scenarios: 1. only the local host has the rsync binary 2. both local and remote hosts have the binary, but neither runs them as a daemon 3. both have the binary and the remote runs as the daemon In #1 you end up using SSH anyway (unless there's also no SSH binary). In…
Wow, thank you - this is exactly what I didn't get.
You explained it super well.
I am number 2, and so I guess it wont affect me as long as the fingerprint doesn't change to a malicious server that have taken over an IP.