Bug 58842
| Summary: | rsync security vulnerability | ||
|---|---|---|---|
| Product: | [Retired] Red Hat Linux | Reporter: | john.l.villalovos |
| Component: | rsync | Assignee: | Bill Nottingham <notting> |
| Status: | CLOSED ERRATA | QA Contact: | Aaron Brown <abrown> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.2 | CC: | rvokal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2002-01-25 19:09:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
errata has been release. |
From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.7) Gecko/20011221 Description of problem: Taken from a SuSE security advisory. I believe that Red Hat is using the same version of rsync mentioned. SuSE Security Announcement Package: rsync Announcement-ID: SuSE-SA:2002:004 Date: Fri Jan 25 17:00:00 CET 2002 Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: remote command executionn Severity (1-10): 7 SuSE default package: no Other affected systems: All systems with vulnerable rsync. Content of this advisory: 1) security vulnerability resolved: rsync negative array indexing problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The rsync program allows users and administrators to synchronize files and whole directory structures on different machines. It is common practise to allow remote users to mirror ftp servers via anonymous rsync access. There exist several signedness bugs within the rsync program which allow remote attackers to write 0-bytes to almost arbitrary stack-locations, therefore being able to control the programflow and obtaining a shell remotely. These bugs have been fixed. It is recommended (also stated in the rsync documentation) to use the "use chroot" option in rsyncd's configuration file (/etc/rsyncd.conf) to limit the impact of a possible attack. Since this workaround does not completely solve the security problem, we recommend to update the package as described below. We want to express our gratitude to Andrew Tridgell and Martin Pool, the rsync authors and maintainers, for their excellent cooperation in this matter. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Run rsync 2. 3. Additional info: