Rapid7 Vulnerability & Exploit Database

RHSA-2002:018: New rsync packages available

Back to Search

RHSA-2002:018: New rsync packages available

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
02/27/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

New rsync packages are available; these fix a remotely exploitable problem in the I/O functions. These include the security patch from the recently released rsync-2.5.2. It is strongly recommended that all users of rsync upgrade to the fixed packages. 2002-01-28: There was an error in the original bugfix patch for the security problem - the new rsync could fail under some circumstances. This has been fixed in a new build.

rsync is a powerful tool used for mirroring directory structures across machines. rsync has been found to contain several signed/unsigned bugs in its I/O functions which are remotely exploitable. A remote user can crash the rsync server/client and execute code as the user running the rsync server or client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0048 to this issue. All users of rsync should upgrade their packages. In addition rsync server administrators should consider using the "use chroot", "uid", and "read only" options, which can significantly reduce the impact of a security problem in rsync or elsewhere. Thanks go to Sebastian Krahmer for providing a patch for this vulnerability and to Andrew Tridgell and Martin Pool for their rapid response.

Solution(s)

  • redhat-upgrade-rsync

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;