Sixty vulnerabilities were patched in the latest version of file transfer utility Rsync, including two allowing malicious code execution on servers. Clients only need anonymous read-access for exploitation. Hackers could also control a server to read/write files from any connected client, potentially extracting sensitive data. All issues affect Rsync versions prior to v3.4.0. Users are urged to implement the fixes, and updated Rsync packages have been released for Ubuntu and Debian.
The NCSC wants developers to get serious on software security
The NCSC’s new Software Security Code of Practice has been praised by cyber professionals as a significant advancement in enhancing software supply chain security.
