Conectiva Linux Advisory: rsync

CONECTIVA LINUX SECURITY ANNOUNCEMENT

DESCRIPTION
“rsync”[1] is a program used mainly to mirror files between remote
sites.

rsync versions prior to 2.5.7 have a heap buffer overflow
vulnerability[2] which can be exploited by remote attackers to
execute arbitrary code.

This vulnerability specially affects installations where rsync
is used as a server/daemon, that is, where it was started with the
–daemon command line argument.

A new rsync version, 2.5.7, was released by the authors to
address this vulnerability.

SOLUTION
It is recommended that all rsync users upgrade their packages.

IMPORTANT: after the update, the rsync server must be restarted
manually if it was already running.

REFERENCES

1. http://rsync.samba.org/
2. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0962

UPDATED PACKAGES

ftp://atualizacoes.conectiva.com.br/8/SRPMS/rsync-2.5.7-5U80_1cl.src.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/rsync-2.5.7-5U80_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/9/SRPMS/rsync-2.5.7-13508U90_1cl.src.rpm

ftp://atualizacoes.conectiva.com.br/9/RPMS/rsync-2.5.7-13508U90_1cl.i386.rpm

ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

• run: apt-get update
• after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en

Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com