bugtraq - [ MDKSA-2007:166 ] - Updated rsync packages fix off-by-one buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <E1IMYic-0000Ys-Dn@artemis.annvix.ca>
Date: Sat, 18 Aug 2007 18:32:38 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2007:166 ] - Updated rsync packages fix off-by-one buffer
 overflow


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:166
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : rsync
 Date    : August 18, 2007
 Affected: 2007.0, 2007.1, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 Sebastian Krahmer of the SUSE Security Team discovered an off-by-one
 buffer overflow within rsync.  It is not clear if this problem is
 exploitable, however updates are available to correct the issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4091
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 7b0c5424444c99181f9283f8d584820b  2007.0/i586/rsync-2.6.8-3.1mdv2007.0.i586.rpm 
 8422a0235e1bd6a69a5d452f461df534  2007.0/SRPMS/rsync-2.6.8-3.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 52676839c4467ca1cd80cd7976757cea  2007.0/x86_64/rsync-2.6.8-3.1mdv2007.0.x86_64.rpm 
 8422a0235e1bd6a69a5d452f461df534  2007.0/SRPMS/rsync-2.6.8-3.1mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 915d44a76b37ec5e17b0899849e527db  2007.1/i586/rsync-2.6.9-1.1mdv2007.1.i586.rpm 
 38b3ca6d286049cb04c54f7f10e5186e  2007.1/SRPMS/rsync-2.6.9-1.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 0681877f97a2d02d8bc95295626560d9  2007.1/x86_64/rsync-2.6.9-1.1mdv2007.1.x86_64.rpm 
 38b3ca6d286049cb04c54f7f10e5186e  2007.1/SRPMS/rsync-2.6.9-1.1mdv2007.1.src.rpm

 Corporate 4.0:
 d0aa26829de006aab9cc0ce237f81a96  corporate/4.0/i586/rsync-2.6.6-1.1.20060mlcs4.i586.rpm 
 417cd6ce0a47db43d97dfea6b098a580  corporate/4.0/SRPMS/rsync-2.6.6-1.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 98f1f8032c050a9687e691a017162e54  corporate/4.0/x86_64/rsync-2.6.6-1.1.20060mlcs4.x86_64.rpm 
 417cd6ce0a47db43d97dfea6b098a580  corporate/4.0/SRPMS/rsync-2.6.6-1.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGx2SqmqjQ0CJFipgRAjY+AJwIauX4dyBl6FWDsPJT259LrGgqHQCgom+8
M6tbHPJ1dRyJeipy7mmTwAg=
=WsvZ
-----END PGP SIGNATURE-----