CONECTIVA LINUX SECURITY ANNOUNCEMENT
| PACKAGE | : | rsync |
| SUMMARY | : | Fix for remote vulnerability |
| DATE | : | 2003-12-04 18:46:00 |
| ID | : | CLA-2003:794 |
| RELEVANT RELEASES | : | 8, 9 |
DESCRIPTION
“rsync”[1] is a program used mainly to mirror files between remote
sites.
rsync versions prior to 2.5.7 have a heap buffer overflow
vulnerability[2] which can be exploited by remote attackers to
execute arbitrary code.
This vulnerability specially affects installations where rsync
is used as a server/daemon, that is, where it was started with the
–daemon command line argument.
A new rsync version, 2.5.7, was released by the authors to
address this vulnerability.
SOLUTION
It is recommended that all rsync users upgrade their packages.
IMPORTANT: after the update, the rsync server must be restarted
manually if it was already running.
REFERENCES
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/rsync-2.5.7-5U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/rsync-2.5.7-5U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/rsync-2.5.7-13508U90_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/rsync-2.5.7-13508U90_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com