A half-dozen recently disclosed vulnerabilities in the Rsync file synchronization tool include a pair of flaws that when combined could allow arbitrary code execution: CVE-2024-12084 is a critical heap-based buffer overflow vulnerability in the rsync daemon “due to improper handling of attacker-controlled checksum lengths (s2length) in the code.” CVE-2024-12085 is a high-severity vulnerability in the Rsync daemon that be “be triggered when rsync compares file checksums.” The other four vulnerabilities are medium-severity issues. The results of a Shodan search by Bleeping Computer revealed “over 660,000 IP addresses with exposed Rsync servers.” More https://www.helpnetsecurity.com/2025/01/15/rsync-vulnerabilities-allow-remote-code-execution-on-servers-patch-quickly/
