SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Rsync Vendors:   rsync.samba.org
(SCO Issues Fix for OpenLinux) Rsync Heap Overflow in Daemon Mode Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1009323
SecurityTracker URL:  http://securitytracker.com/id/1009323
CVE Reference:   CVE-2003-0962   (Links to External Site)
Date:  Mar 5 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.5.6 and prior versions
Description:   A vulnerability was reported in rsync. A remote user can execute arbitrary code on the target system.

It is reported that a remote user can connect to a target server running rsync on TCP port 873 and send specially crafted data to execute arbitrary code. The code will run with the privileges of the rsync daemon.

Only systems that are running rsync in daemon mode are reportedly affected.

Impact:   A remote user can execute arbitrary code with the privileges of the rsync daemon.
Solution:   SCO has issued the following fixes.

OpenLinux 3.1.1 Server:

Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-010.0/RPMS

Packages

4fb00e592531f020fcb4f42153c27b47 rsync-2.5.7-1.i386.rpm

Installation

rpm -Fvh rsync-2.5.7-1.i386.rpm

Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-010.0/SRPMS

Source Packages

04c03598ea2f99c603933b7a0f1132a3 rsync-2.5.7-1.src.rpm


OpenLinux 3.1.1 Workstation:

Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-010.0/RPMS

Packages

c2cf07248715486ecb89235a69183eb2 rsync-2.5.7-1.i386.rpm

Installation

rpm -Fvh rsync-2.5.7-1.i386.rpm

Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-010.0/SRPMS

Source Packages

eb5c948fd8bb5128230346ac51f48a35 rsync-2.5.7-1.src.rpm

Vendor URL:  rsync.samba.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  3.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Dec 4 2003 Rsync Heap Overflow in Daemon Mode Lets Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [Full-Disclosure] OpenLinux: rsync heap based overflow



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenLinux: rsync heap based overflow
Advisory number: 	CSSA-2004-010.0
Issue date: 		2004 March 02
Cross reference:	sr888533 fz528609 erg712514 CAN-2003-0962
______________________________________________________________________________


1. Problem Description

	Heap-based buffer overflow in rsync before 2.5.7, when running in
	server mode, allows remote attackers to execute arbitrary code
	and possibly escape the chroot jail. 

	The Common Vulnerabilities and Exposures project (cve.mitre.org) 
	has assigned the name CAN-2003-0962 to this issue.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------
	OpenLinux 3.1.1 Server		prior to rsync-2.5.7-1.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to rsync-2.5.7-1.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-010.0/RPMS

	4.2 Packages

	4fb00e592531f020fcb4f42153c27b47	rsync-2.5.7-1.i386.rpm

	4.3 Installation

	rpm -Fvh rsync-2.5.7-1.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-010.0/SRPMS

	4.5 Source Packages

	04c03598ea2f99c603933b7a0f1132a3	rsync-2.5.7-1.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-010.0/RPMS

	5.2 Packages

	c2cf07248715486ecb89235a69183eb2	rsync-2.5.7-1.i386.rpm

	5.3 Installation

	rpm -Fvh rsync-2.5.7-1.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-010.0/SRPMS

	5.5 Source Packages

	eb5c948fd8bb5128230346ac51f48a35	rsync-2.5.7-1.src.rpm


6. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0962


	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr888533 fz528609
	erg712514.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


8. Acknowledgements

	SCO would like to thank Mike Warfield, Paul Russell, and  Andrea Barisani 
______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFARUytbluZssSXDTERAs86AJwMNzvIj54GMsSDhYxJKY6tBGSPNACfWwXE
QW+REMhisLAnfD784BsdlCo=
=Ueoz
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC