Rapid7 Vulnerability & Exploit Database

RHSA-2011:0390: rsync security update

Back to Search

RHSA-2011:0390: rsync security update

Severity
5
CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
Published
03/30/2011
Created
07/25/2018
Added
04/14/2011
Modified
07/04/2017

Description

rsync is a program for synchronizing files over a network.A memory corruption flaw was found in the way the rsync client processedmalformed file list data. If an rsync client used the "--recursive" and"--delete" options without the "--owner" option when connecting to amalicious rsync server, the malicious server could cause rsync on theclient system to crash or, possibly, execute arbitrary code with theprivileges of the user running rsync. (CVE-2011-1097)Red Hat would like to thank Wayne Davison and Matt McCutchen for reportingthis issue.Users of rsync should upgrade to this updated package, which contains abackported patch to resolve this issue.

Solution(s)

  • redhat-upgrade-rsync
  • redhat-upgrade-rsync-debuginfo

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;