It was found [1] that when rsync is configured to authenticate users, a remote attacker could send a request using an invalid username that, when processed by rsync, would cause the rsync daemon to enter an infinite loop. Multiple requests to a single server using rsync with authentication of users could result in a denial of service through CPU exhaustion. This issue has been reported and fixed upstream in version 3.1.1 [1] with a patch available at [2]. The CVE request for this issue is available at [3]. [1] https://bugzilla.samba.org/show_bug.cgi?id=10551 [2] https://git.samba.org/?p=rsync.git;a=commitdiff;h=0dedfbce2c1b851684ba658861fe9d620636c56a [3] http://seclists.org/oss-sec/2014/q2/110
Created rsync tracking bugs for this issue: Affects: fedora-all [bug 1087843]
MITRE assigned CVE-2014-2855 to this issue: http://seclists.org/oss-sec/2014/q2/113
rsync-3.1.0-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This was introduced via https://git.samba.org/?p=rsync.git;a=commitdiff;h=5ebe9a46d7f3c846a6d665cb8c6ab8b79508a6df and first made it into rsync 3.1.0. We ship earlier versions in RHEL. Statement: Not vulnerable. This issue did not affect the versions of rsync as shipped with Red Hat Enterprise Linux 5 and 6.