Stay Secure with the Latest Linux Advisories

security advisorycriticalslackware

Slackware: 2003-337-01 Critical: Rsync Code Threat Fix in Daemon Mode

Rsync is a file transfer client and server. A security problem which may lead to unauthorized machine access or code execution has been fixed by upgrading to rsync-2.5.7. This problem only affects machines running rsync in daemon mode, . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] rsync security update (SSA:2003-337-01) Rsync is a file transfer client and server. A security problem which may lead to unauthorized machine access or code execution has been fixed by upgrading to rsync-2.5.7. This problem only affects machines running rsync in daemon mode, and is easier to exploit if the non-default option "use chroot = no" is used in the /etc/rsyncd.conf config file. Any sites running an rsync server should upgrade immediately. For complete information, see the rsync home page: / Here are the details from the Slackware 9.1 ChangeLog: +--------------------------+ Wed Dec 3 22:18:35 PST 2003 patches/packages/rsync-2.5.7-i486-1.tgz: Upgraded to rsync-2.5.7. From the rsync-2.5.7-NEWS file: SECURITY: * Fix buffer handling bugs. (Andrew Tridgell, Martin Pool, Paul Russell, Andrea Barisani) The vulnerability affects sites running rsync in daemon mode (rsync servers). These sites should be upgraded immediately. (* Security fix *) +--------------------------+ WHERE TO FIND THE NEW PACKAGE: +-----------------------------+ Updated package for Slackware 8.1: Updated package for Slackware 9.0: Updated package for Slackware 9.1: Updated package for Slackware -current: MD5 SIGNATURES: +-------------+ Slackware 8.1 package: 9adcdfaeca3022204bc1bef1d97802cf rsync-2.5.7-i386-1.tgz Slackware 9.0 package: 12788c9af15174c683ada4c5e5746372 rsync-2.5.7-i386-1.tgz Slackware 9.1 package: 38d40a65d526f92c41ff72afae74e546 rsync-2.5.7-i486-1.tgz Slackware -current package: 3f68fa78c6d095da4269e27806596d48 rsync-2.5.7-i486-1.tgz INSTALLATION INSTRUCTIONS: +------------------------+ If you're running rsync as a daemon, kill it: # killall rsync Then, upgrade thepackage: # upgradepkg rsync-2.5.7-i486-1.tgz Finally, restart the rsync daemon: # rsync --daemon +-----+ . Rsync enhances protection against unauthorized entry in daemon mode. Transition to version 2.5.7 to fortify your systems reliably.. Rsync Update, Code Threat, Daemon Mode Risks. . Severity: Critical. LinuxSecurity.com Team

Dec 04, 2003 •Critical Slackware