Bug 1087841 (CVE-2014-2855)

Summary:	CVE-2014-2855 rsync: CPU consumption denial of service when authenticating with a non-existent username
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jkurik, mluscon, pfrields, psimerda, ssorce
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-05-28 09:13:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1087843
Bug Blocks:	1087846

Description Martin Prpič 2014-04-15 12:38:24 UTC

It was found [1] that when rsync is configured to authenticate users, a remote attacker could send a request using an invalid username that, when processed by rsync, would cause the rsync daemon to enter an infinite loop. Multiple requests to a single server using rsync with authentication of users could result in a denial of service through CPU exhaustion.

This issue has been reported and fixed upstream in version 3.1.1 [1] with a patch available at [2].

The CVE request for this issue is available at [3].

[1] https://bugzilla.samba.org/show_bug.cgi?id=10551
[2] https://git.samba.org/?p=rsync.git;a=commitdiff;h=0dedfbce2c1b851684ba658861fe9d620636c56a
[3] http://seclists.org/oss-sec/2014/q2/110

Comment 1 Martin Prpič 2014-04-15 12:40:09 UTC

Created rsync tracking bugs for this issue:

Affects: fedora-all [bug 1087843]

Comment 2 Martin Prpič 2014-04-15 14:51:28 UTC

MITRE assigned CVE-2014-2855 to this issue:

http://seclists.org/oss-sec/2014/q2/113

Comment 3 Fedora Update System 2014-04-20 01:29:54 UTC

rsync-3.1.0-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Stefan Cornelius 2014-05-28 09:13:37 UTC

This was introduced via https://git.samba.org/?p=rsync.git;a=commitdiff;h=5ebe9a46d7f3c846a6d665cb8c6ab8b79508a6df and first made it into rsync 3.1.0. We ship earlier versions in RHEL.

Statement:

Not vulnerable. This issue did not affect the versions of rsync as shipped with Red Hat Enterprise Linux 5 and 6.