bugtraq - MDKSA-2003:111 - Updated rsync packages fix heap overflow vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 4 Dec 2003 23:11:26 -0000
From: Mandrake Linux Security Team <security@...ux-mandrake.com>
To: bugtraq@...urityfocus.com
Subject: MDKSA-2003:111 - Updated rsync packages fix heap overflow vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                Mandrake Linux Security Update Advisory
 _______________________________________________________________________

 Package name:           rsync
 Advisory ID:            MDKSA-2003:111
 Date:                   December 4th, 2003

 Affected versions:	 9.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 A vulnerability was discovered in all versions of rsync prior to 2.5.7
 that was recently used in conjunction with the Linux kernel do_brk()
 vulnerability to compromise a public rsync server.
 
 This heap overflow vulnerability, by itself, cannot yield root access,
 however it does allow arbitrary code execution on the host running
 rsync as a server.  Also note that this only affects hosts running
 rsync in server mode (listening on port 873, typically under xinetd).
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0962
  http://rsync.samba.org/index.html
 ______________________________________________________________________

 Updated Packages:
  
 Corporate Server 2.1:
 9bc8cc0d702a6b443f4e9317c8821b1f  corporate/2.1/RPMS/rsync-2.5.5-5.1.C21mdk.i586.rpm
 01b24d9543fd1048c2b60b7540df5855  corporate/2.1/SRPMS/rsync-2.5.5-5.1.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 77aaea222c1ae12fd94e44bd2ccdd13e  x86_64/corporate/2.1/RPMS/rsync-2.5.5-5.1.C21mdk.x86_64.rpm
 01b24d9543fd1048c2b60b7540df5855  x86_64/corporate/2.1/SRPMS/rsync-2.5.5-5.1.C21mdk.src.rpm

 Mandrake Linux 9.0:
 176a59edc02391381bd8c65ba9c535b2  9.0/RPMS/rsync-2.5.5-5.1.90mdk.i586.rpm
 33c6c7dd1a9057d859028c748601f223  9.0/SRPMS/rsync-2.5.5-5.1.90mdk.src.rpm

 Mandrake Linux 9.1:
 f62e360a268f5d258a7116127d89c322  9.1/RPMS/rsync-2.5.7-0.1.91mdk.i586.rpm
 8a1ff0d2ba41c0e12f0e3e434c34d2c2  9.1/SRPMS/rsync-2.5.7-0.1.91mdk.src.rpm

 Mandrake Linux 9.1/PPC:
 0fe2b91fba74687f9cff0db22706f330  ppc/9.1/RPMS/rsync-2.5.7-0.1.91mdk.ppc.rpm
 8a1ff0d2ba41c0e12f0e3e434c34d2c2  ppc/9.1/SRPMS/rsync-2.5.7-0.1.91mdk.src.rpm

 Mandrake Linux 9.2:
 41edd9f6879a380fde978594915e520c  9.2/RPMS/rsync-2.5.7-0.1.92mdk.i586.rpm
 54cd027ef28c50ba918971a588d6506b  9.2/SRPMS/rsync-2.5.7-0.1.92mdk.src.rpm

 Multi Network Firewall 8.2:
 bc447c3f0e1ad99e80c65caa4ac22ee4  mnf8.2/RPMS/rsync-2.5.4-2.1.M82mdk.i586.rpm
 5ec35ae267cc5b3026b269e1d76171b6  mnf8.2/SRPMS/rsync-2.5.4-2.1.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 A list of FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

 All packages are signed by MandrakeSoft for security.  You can obtain
 the GPG public key of the Mandrake Linux Security Team by executing:

  gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98

 Please be aware that sometimes it takes the mirrors a few hours to
 update.

 You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

 MandrakeSoft has several security-related mailing list services that
 anyone can subscribe to.  Information on these lists can be obtained by
 visiting:

  http://www.mandrakesecure.net/en/mlist.php

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/z78emqjQ0CJFipgRAttCAKDIe70Wqoh6UcUVSAgBZbe0pamAdwCgtKqW
yNU5Xs18m/d/pDqOILvJdGU=
=smAL
-----END PGP SIGNATURE-----