Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

Ubuntu 10.10 LTS USN-1124-1 Critical: Rsync Denial of Service

ubuntu
Calendar Grey April 27, 2011
Scroller Ubuntu
An urgent security flaw in rsync for Ubuntu enables remote adversaries to run arbitrary code or instigate denial of service through compromised servers.
rsync could be made to crash or run programs as your login if it connected to a malicious server.

Summary

rsync could be made to crash or run programs as your login if it connected

to a malicious server.

Software Description:

- rsync: fast remote file copy program (like rcp)

Details:

It was discovered that rsync incorrectly handled memory when certain

recursion, deletion and ownership options were used. If a user were tricked

into connecting to a malicious server, a remote attacker could cause a

denial of service or execute arbitrary code with privileges of the user

invoking the program.

Topics%20covered

Topics Covered

security advisory denial of service code execution rsync ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  rsync                           3.0.7-2ubuntu1.1

Ubuntu 10.04 LTS:
  rsync                           3.0.7-1ubuntu1.1

Ubuntu 9.10:
  rsync                           3.0.6-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

CVE-2011-1097

Severity
critical
Lowest
Low
Medium
High
Critical

April 27, 2011

Topics%20covered

Topics Covered

security advisory denial of service code execution rsync ubuntu

Package Information

https://launchpad.net/ubuntu/+source/rsync/3.0.7-2ubuntu1.1
https://launchpad.net/ubuntu/+source/rsync/3.0.7-1ubuntu1.1
https://launchpad.net/ubuntu/+source/rsync/3.0.6-1ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.