Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200804-16 ] rsync: Execution of arbitrary code
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Advocate
Advocate


Joined: 12 May 2004
Posts: 2663

PostPosted: Thu Apr 17, 2008 12:26 pm    Post subject: [ GLSA 200804-16 ] rsync: Execution of arbitrary code Reply with quote

Gentoo Linux Security Advisory

Title: rsync: Execution of arbitrary code (GLSA 200804-16)
Severity: high
Exploitable: remote
Date: April 17, 2008
Bug(s): #216887
ID: 200804-16

Synopsis


A buffer overflow in rsync might lead to the remote execution of arbitrary
code when extended attributes are being used.


Background


rsync is a file transfer program to keep remote directories
synchronized.


Affected Packages

Package: net-misc/rsync
Vulnerable: < 2.6.9-r6
Unaffected: >= 2.6.9-r6
Architectures: All supported architectures


Description


Sebastian Krahmer of SUSE reported an integer overflow in the
expand_item_list() function in the file util.c which might lead to a
heap-based buffer overflow when extended attribute (xattr) support is
enabled.


Impact


A remote attacker could send a file containing specially crafted
extended attributes to an rsync deamon, or entice a user to sync from
an rsync server containing specially crafted files, possibly leading to
the execution of arbitrary code.

Please note that extended attributes are only enabled when USE="acl" is
enabled, which is the default setting.


Workaround


Disable extended attributes in the rsync daemon by setting " refuse
options = xattrs
" in the file "/etc/rsyncd.conf" (or append
"xattrs" to an existing "refuse" statement). When synchronizing to a
server, do not provide the "-X" parameter to rsync. You can also
disable the "acl" USE flag for rsync and recompile the package.


Resolution


All rsync users should upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=net-misc/rsync-2.6.9-r6"


References

CVE-2008-1720


Last edited by GLSA on Tue Feb 24, 2015 4:26 am; edited 4 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum