Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200804-16 ] rsync: Execution of arbitrary code
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1567

PostPosted: Thu Apr 17, 2008 12:26 pm    Post subject: [ GLSA 200804-16 ] rsync: Execution of arbitrary code Reply with quote

Gentoo Linux Security Advisory

Title: rsync: Execution of arbitrary code (GLSA 200804-16)
Severity: high
Exploitable: remote
Date: April 17, 2008
Bug(s): #216887
ID: 200804-16

Synopsis

A buffer overflow in rsync might lead to the remote execution of arbitrary code when extended attributes are being used.

Background

rsync is a file transfer program to keep remote directories synchronized.

Affected Packages

Package: net-misc/rsync
Vulnerable: < 2.6.9-r6
Unaffected: >= 2.6.9-r6
Architectures: All supported architectures


Description

Sebastian Krahmer of SUSE reported an integer overflow in the expand_item_list() function in the file util.c which might lead to a heap-based buffer overflow when extended attribute (xattr) support is enabled.

Impact

A remote attacker could send a file containing specially crafted extended attributes to an rsync deamon, or entice a user to sync from an rsync server containing specially crafted files, possibly leading to the execution of arbitrary code. Please note that extended attributes are only enabled when USE="acl" is enabled, which is the default setting.

Workaround

Disable extended attributes in the rsync daemon by setting " refuse options = xattrs " in the file "/etc/rsyncd.conf" (or append "xattrs" to an existing "refuse" statement). When synchronizing to a server, do not provide the "-X" parameter to rsync. You can also disable the "acl" USE flag for rsync and recompile the package.

Resolution

All rsync users should upgrade to the latest version:
Code:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/rsync-2.6.9-r6"


References

CVE-2008-1720


Last edited by GLSA on Tue Jul 07, 2009 4:18 am; edited 2 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum