Security hole in rsync

The security breach occurs when you try to transfer an empty directory into a non-existent directory. In that case rsync sets the permissions of the working directory to those of the empty directory; this means, that the permissions of your home directory are changed to the file access mode of the empty directory if you do a remote rsync by using ssh/rsh.

______________________________________________________________________________

                        SuSE Security Announcement

        Package:  rsync-2.2.1 and previous
        Date:     Tue Aug 25 07:45:15 CEST 1999
        Affected: all Linux distributions using rsync
______________________________________________________________________________

A security hole was discovered in the package mentioned above.
Please update as soon as possible or disable the service if you are using
this software on your SuSE Linux installation(s).

Other Linux distributions or operating systems might be affected as
well, please contact your vendor for information about this issue.

Please note, that that we provide this information on as "as-is" basis only.
There is no warranty whatsoever and no liability for any direct, indirect or
incidental damage arising from this information or the installation of
the update package.
_____________________________________________________________________________

1. Problem Description

  The security breach occurs when you try to transfer an empty
  directory into a non-existent directory.
  In that case rsync sets the permissions of the working directory
  to those of the empty directory; this means, that the permissions
  of your home directory are changed to the file access mode of the
  empty directory if you do a remote rsync by using ssh/rsh.

2. Impact

  If an attacker is successful in exploiting this bug, s/he could gain
  access to protected files in a users home directory.
  This could lead to local root compromise, i.e. by modifying the PATH
  environment variable and smuggleing tronjan horse programs in the
  admins home directory or elsewhere. 

3. Solution

  Updated the rsync package from our FTP server.
______________________________________________________________________________

Here are the md5 checksums of the upgrade packages, please verify these
before installing the new packages:

  ca7573738420869c7750a25d53e7ac95  rsync-2.3.1-0.i386.rpm
______________________________________________________________________________

You will find the update on our ftp-Server:
  ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/rsync.rpm

Webpage for patches:
  http://www.suse.de/patches/index.html

or try the following web pages for a list of mirrors:
  http://www.suse.de/ftp.html
  http://www.suse.com/ftp_new.html

______________________________________________________________________________