bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

17,000 Linux servers vulnerable to critical rsync hole

Summary

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

Ideas

  • Anonymous read access to an rsync daemon is enough as a way in.
  • Detection was based on the version number reported on port 873.
  • rsync is part of many backup tools and often runs unnoticed.
  • Around 88 percent of reachable servers had already been patched.

Insights

  • Inconspicuous infrastructure tools are often forgotten because they simply work for years.
  • Open services without login are immediately attackable with every new hole.

Facts

  • Worldwide, 146,844 rsync servers were reachable without a password.
  • The patched version 3.4.0 appeared on 14 January 2025.

References

Critique

  • The count is based on version information and covers neither backported patches nor password-protected servers.

Recommendations

  • Do not run rsync as an open daemon, but over SSH.
  • Check whether backup tools open an rsync service unnoticed.

Read the original article

Search the Web Archive

g · 2006

Linux also vulnerable to the WMF security hole through Wine

In January 2006 the WMF hole, through which manipulated image files executed code under Windows, also affected Wine, Cedega and CrossOver Office. According to HD Moore, author of the proof of concept, the complete metafile API had been recreated in Wine, including the bug. Not only Windows code but also native shellcode could be executed, and Marcus Meissner of SUSE supplied a patch.

g · 2023

Security hole in SugarCRM servers actively exploited

In early 2023 attackers exploited a critical hole in SugarCRM (CVE-2023-22952) to take over servers and install malware. Authentication could be bypassed via the path /index.php/, after which a POST request uploaded a PNG file containing PHP code that was executed when called up later. By 11 January Censys found 354 compromised servers, just under twelve percent of all 3,059 reachable instances.

g · 2013

Critical security hole in the Security Manager

In January 2013 an already actively exploited hole became known in the Security Manager of Java 7 up to and including Update 10. A combination of JMX MBean and internal JavaScript classes in an applet could be used to bypass the Security Manager and execute code from websites. US-CERT recommended disabling Java in the browser; there was no patch from Oracle yet.