RHSA-2011:0390: rsync security update
Description
rsync is a program for synchronizing files over a network.A memory corruption flaw was found in the way the rsync client processedmalformed file list data. If an rsync client used the "--recursive" and"--delete" options without the "--owner" option when connecting to amalicious rsync server, the malicious server could cause rsync on theclient system to crash or, possibly, execute arbitrary code with theprivileges of the user running rsync. (CVE-2011-1097)Red Hat would like to thank Wayne Davison and Matt McCutchen for reportingthis issue.Users of rsync should upgrade to this updated package, which contains abackported patch to resolve this issue.
Solution(s)
- redhat-upgrade-rsync
- redhat-upgrade-rsync-debuginfo
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center