CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : rsync
SUMMARY : Fix for path sanitation vulnerabilities
DATE : 2004-11-01 12:20:00
ID : CLA-2004:881
RELEVANT RELEASES : 9, 10
rsync is a program used mainly to mirror files between remote
rsync before 2.6.1 does not properly sanitize paths when
running a read and write daemon without using chroot. This could
allow a remote attacker to write files outside of the rsync
directory, depending on rsync’s daemon privileges.
Also, rsync prior to version 2.6.3 has another path sanitization
vulnerability. This issue could allow a remote attacker to read
or write files outside of the rsync directory. This vulnerability
is only exploitable when an rsync daemon is running and not within
a chroot, which is not the default configuration.
It is recommended that all rsync users upgrade their packages.
IMPORTANT: after the update, the rsync server must be restarted
manually if it was already running.
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
Copyright (c) 2004 Conectiva Inc.