[USN-600-1] rsync vulnerability
Date: Thu, 10 Apr 2008 23:52:11 -0700
From: Kees Cook <kees@ubuntu.com.>
To: [email protected]
Subject: [USN-600-1] rsync vulnerability
Message-ID: <20080411065211.GT18929@outflux.net.>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="OzxllxdKGCiKxUZM"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.310 $
X-HELO: www.outflux.net
X-Scanned-By: MIMEDefang 2.57 on 10.2.0.1
X-Virus-Scanned: antivirus-gw at tyumen.ru
--OzxllxdKGCiKxUZM
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=20
Ubuntu Security Notice USN-600-1 April 11, 2008
rsync vulnerability
CVE-2008-1720
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 7.04
Ubuntu 7.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 7.04:
rsync 2.6.9-3ubuntu1.2
Ubuntu 7.10:
rsync 2.6.9-5ubuntu1.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
Sebastian Krahmer discovered that rsync could overflow when handling ACLs.
An attacker could construct a malicious set of files that when processed
by rsync could lead to arbitrary code execution or a crash.
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-3ubuntu=
1.2.diff.gz
Size/MD5: 39403 9633c4376d4aa5d8e4c3da99405ca0d6
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-3ubuntu=
1.2.dsc
Size/MD5: 658 08549083557957c66e73e42aa683f1b5
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9.orig.ta=
r.gz
Size/MD5: 811841 996d8d8831dbca17910094e56dcb5942
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-3ubuntu=
1.2_amd64.deb
Size/MD5: 275936 633f49faf8c061d199fa1fa109e4d46a
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-3ubuntu=
1.2_i386.deb
Size/MD5: 262086 381d1741edd2151b09fdfcd11829246f
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-3ubuntu=
1.2_powerpc.deb
Size/MD5: 282406 e8704361305a8308274b253863876766
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-3ubuntu=
1.2_sparc.deb
Size/MD5: 270148 d6af336d9d029920c4c9b308e50f1e45
Updated packages for Ubuntu 7.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-5ubuntu=
1.1.diff.gz
Size/MD5: 40051 f86fdffdfeb406e1164dd8573c527174
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-5ubuntu=
1.1.dsc
Size/MD5: 658 6ce35afac1779ce799dd10e42535bcb7
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9.orig.ta=
r.gz
Size/MD5: 811841 996d8d8831dbca17910094e56dcb5942
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-5ubuntu=
1.1_amd64.deb
Size/MD5: 277264 2652f8655e5f33073a90e0d25559aada
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-5ubuntu=
1.1_i386.deb
Size/MD5: 263124 90761cc1de553a35fb6c719e5632b84d
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-5ubuntu=
1.1_powerpc.deb
Size/MD5: 283556 cc28973832efb6c5e2fe82893ce774d4
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/r/rsync/rsync_2.6.9-5ubuntu=
1.1_sparc.deb
Size/MD5: 271206 4909fa7ccc14431f6419f51da2487400
--OzxllxdKGCiKxUZM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFH/wqbH/9LqRcGPm0RAp7IAJ0XRX6tkkWybKuR33PT854ZbDjblgCeLpmN
Pe+Q1JamYdX9DzIArLlTLSk=
=7YbT
-----END PGP SIGNATURE-----
--OzxllxdKGCiKxUZM--
