EnGarde Secure Linux Security Advisory: rsync

+------------------------------------------------------------------------+
| EnGarde Secure Linux Security Advisory                January 25, 2002 |
| http://www.engardelinux.org/                          ESA-20020125-004 |
|                                                                        |
| Package:  rsync                                                        |
| Summary:  signed integer handling vulnerability                        |
+------------------------------------------------------------------------+

  EnGarde Secure Linux is a secure distribution of Linux that features
  improved access control, host and network intrusion detection, Web
  based secure remote management, complete e-commerce using AllCommerce,
  and integrated open source security tools.


OVERVIEW
- --------
  There is a signed integer handling vulnerability in rsync which can
  allow an attacker to potentially gain root access.


DETAIL
- ------
  There are instances where rsync does not do proper input validation,
  allowing an attacker to write NULL-bytes to somewhat arbitrary locations
  of the stack.  This may potentially lead to a remote root shell.

  The Common Vulnerabilities and Exposures project (cve.mitre.org/) has
  assigned the name CAN-2002-0048 to this issue.


SOLUTION
- --------
  This information applies only to EnGarde Secure Linux Community edition
  users. Registered users of the EnGarde Secure Linux Professional
  edition can use the Guardian Digital Secure Network to upgrade their
  packages automatically.

  All users should upgrade to the most recent version as outlined in
  this advisory.  All updates may be found at:

    ftp://ftp.engardelinux.org/pub/engarde/stable/updates/
    http://ftp.engardelinux.org/pub/engarde/stable/updates/

  Before upgrading the package, the machine must either:

    a) be booted into a "standard" kernel; or
    b) have LIDS disabled.

  To disable LIDS, execute the command:

    # /sbin/lidsadm -S -- -LIDS_GLOBAL

  To install the updated package, execute the command:

    # rpm -Uvh 

  You must now update the LIDS configuration by executing the command:

    # /usr/sbin/config_lids.pl

  To re-enable LIDS (if it was disabled), execute the command:

    # /sbin/lidsadm -S -- +LIDS_GLOBAL

  To verify the signatures of the updated packages, execute the command:

    # rpm -Kv 


UPDATED PACKAGES
- ----------------
  These updated packages are for EnGarde Secure Linux 1.0.1 (Finestra).

  Source Packages:

    SRPMS/rsync-2.4.6-1.0.3.src.rpm
      MD5 Sum: 0d327ed5799c5407df49aa63e1611592

  Binary Packages:

    i386/rsync-2.4.6-1.0.3.i386.rpm
      MD5 Sum: 130608e7f4d1600d8ceb47ad7fe7c4ce

    i686/rsync-2.4.6-1.0.3.i686.rpm
      MD5 Sum: 17dea017e1991234eed30aea4248c479


REFERENCES
- ----------

  Guardian Digital's public key:
    http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY

  CVE Name CAN-2002-0048
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0048

  Credit for the discovery of this bug goes to:
    Sebastian Krahmer 

  rsync's Official Web Site:
    http://rsync.samba.org

  Security Contact:    security@guardiandigital.com
  EnGarde Advisories:  http://www.engardelinux.org/advisories.html

- --------------------------------------------------------------------------
$Id: ESA-20020125-004-rsync,v 1.1 2002/01/25 16:04:36 rwm Exp $
- --------------------------------------------------------------------------
Author: Ryan W. Maple,  
Copyright 2002, Guardian Digital, Inc.