Applications Management Engineer Sr (NYC) Next Step Systems US-NY-New York Post A Job | Post A Resume

tinysofa Security Advisory #2004-020

Package Name: rsync
Summary: Exposure of System Information
Advisory ID: TSSA-2004-020-ES
Date: 2004-08-16

Affected Products: tinysofa enterprise server 2.0

Description

rsync [0] is a program for synchronizing files over a network.

A vulnerability [1] has been reported in rsync, which potentially can be exploited by malicious users to read or write arbitrary files on a vulnerable system.

The vulnerability is caused due to an input validation error within the "sanitize_path()" function of the "util.c" file.

Successful exploitation requires that the rsync daemon isn't running chrooted.

The vulnerability affects version 2.6.2 and prior.

Resolution

The rsync package has been updated to address this vulnerability.

References

Recommended Action

We recommend that all systems with these packages installed be upgraded.

Location

All tinysofa updates are available from
<URI:http://http.tinysofa.org/pub/tinysofa/updates/>
<URI:ftp://ftp.tinysofa.org/pub/tinysofa/updates/>

Automatic Updates

Users of the APT tool can enjoy having updates automatically installed using 'apt-get upgrade'.

Questions?

Check out our mailing lists:
<URI:http://www.tinysofa.org/communicate/>

Verification

This advisory is signed with the tinysofa security sign key.
This key is available from:
<URI:http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xAEDCBB4B>

All tinysofa packages are signed with the tinysofa stable sign key.
This key is available from:
<URI:http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0x0F1240A2>

The advisory is available from the tinysofa errata database at
<URI:http://www.tinysofa.org/support/errata/>
or directly at
<URI:http://www.tinysofa.org/support/errata/2004/020.html>

Updated Packages

SRPMS

606db14378c661b0b5ce1bbb3cd87d52 rsync-2.6.2-2ts.src.rpm

i386

7d8ea97c366ae496d266b168c9c172ca rsync-2.6.2-2ts.i386.rpm

--
tinysofa Security Team <security at tinysofa dot org>