Mageia 2021-0525: rsh security update
Summary
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh serversto bypass intended access restrictions via the filename of . or an empty
filename. The impact is modifying the permissions of the target directory
on the client side. This is similar to CVE-2018-20685. (CVE-2019-7282)
An issue was discovered in rcp in NetKit through 0.17. For an rcp
operation, the server chooses which files/directories are sent to the
client. However, the rcp client only performs cursory validation of the
object name returned. A malicious rsh server (or Man-in-The-Middle
attacker) can overwrite arbitrary files in a directory on the rcp client
machine. This is similar to CVE-2019-6111. (CVE-2019-7283).
References
- https://bugs.mageia.org/show_bug.cgi?id=29675
- https://www.debian.org/lts/security/2021/dla-2822
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7282
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7283
Resolution
MGASA-2021-0525 - Updated rsh packages fix security vulnerability
SRPMS
- 8/core/rsh-0.17-36.1.mga8