Rsync Authorization Bypass Vulnerability via Hostname Resolution

An authorization bypass vulnerability has been identified in Rsync versions through 3.4.2. This vulnerability resides in the hostname-based access control list enforcement of the rsync daemon, particularly when it is configured with chroot. The issue allows attackers to circumvent hostname-based deny rules by manipulating the PTR record of their source IP address. When reverse DNS resolution fails, it defaults to 'UNKNOWN', enabling connections from hostnames that administrators intended to block.

Impact

Exploitation of this vulnerability allows for hostname-based access control bypass, enabling unauthorized connections to the rsync daemon from denied hostnames.

Remediation

Users can upgrade to Rsync version 3.4.3 or later, or use IP-based access control lists instead of hostname-based ones. If hostname-based ACLs must be used, ensure the chroot environment contains the necessary files for reverse DNS resolution.