SecBoard
Zurück zur CVE-Übersicht

CVE-2026-119741

HIGH(7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score24/100 — NIEDRIG
  • CVSS 7.5 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.5

Technische Schwere

Beschreibung

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "rsync" and InitiatingProcessCommandLine contains "--daemon"
| summarize (ConnectionCount) = count() by DeviceId, InitiatingProcessCommandLine, bin(Timestamp, 1h)
| where ConnectionCount > 50 // Adjust threshold based on normal rsync daemon activity
| project DeviceId, InitiatingProcessCommandLine, ConnectionCount, Timestamp
| extend AlertReason = "Potential rsync DoS attempt due to high concurrent connections"

Splunk SPL

index=* sourcetype=syslog (rsync AND daemon) | stats count as ConnectionCount by host, _time | where ConnectionCount > 50 | table host, _time, ConnectionCount | rename _time as Timestamp | eval AlertReason = "Potential rsync DoS attempt due to high concurrent connections"

Sigma

title: Rsync DoS Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential Denial of Service attempts against rsync daemons by monitoring for an unusually high number of concurrent connections.
author: SecBoard
date: 2026/11/03
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains: 'rsync --daemon'
  timeframe: 1h
  condition: selection | count() > 50
  fields:
    - CommandLine
    - Image
falsepositives:
  - Legitimate high-volume rsync operations (requires tuning)
level: high

Elastic ES|QL

from process where process.args contains "rsync" and process.args contains "--daemon" | summarize connection_count = count() by host.name, process.command_line, span(timestamp, 1h) | where connection_count > 50 | project host.name, process.command_line, connection_count, timestamp | set alert_reason = "Potential rsync DoS attempt due to high concurrent connections"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*

Referenzen