New rsync packages are available; these fix a remotely exploitable problem in the I/O functions. These include the security patch from the recently released rsync-2.5.2. It is strongly recommended that all users of rsync upgrade to the fixed packages. 2002-01-28: There was an error in the original bugfix patch for the security problem - the new rsync could fail under some circumstances. This has been fixed in a new build.
rsync is a powerful tool used for mirroring directory structures across machines. rsync has been found to contain several signed/unsigned bugs in its I/O functions which are remotely exploitable. A remote user can crash the rsync server/client and execute code as the user running the rsync server or client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0048 to this issue. All users of rsync should upgrade their packages. In addition rsync server administrators should consider using the "use chroot", "uid", and "read only" options, which can significantly reduce the impact of a security problem in rsync or elsewhere. Thanks go to Sebastian Krahmer for providing a patch for this vulnerability and to Andrew Tridgell and Martin Pool for their rapid response.