Subject: [yellowdog-updates] Yellow Dog Linux Security Update: YDU-20020127-3
dburcaw@newhope.terraplex.com
Date: Sun Jan 27 2002 - 18:16:55 MST
Yellow Dog Linux Security Announcement
--------------------------------------
Package: rsync
Issue Date: January 27, 2002
Priority: high
Advisory ID: YDU-20020127-3
1. Topic:
New rsync packages are available; these fix a remotely exploitable problem
in the I/O functions.
It is strongly recommended that all users of rsync upgrade to the fixed
packages.
2. Problem:
rsync is a powerful tool used for mirroring directory structures across
machines. rsync has been found to contain several signed/unsigned bugs in
its I/O functions which are remotely exploitable. A remote user can crash
the rsync server/client and execute code as the user running the rsync
server or client.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0048 to this issue.
All users of rsync should upgrade their packages. In addition rsync server
administrators should consider using the "use chroot", "uid", and "read
only" options, which can significantly reduce the impact of a security
problem in rsync or elsewhere.
Thanks go to Sebastian Krahmer for providing a patch for this vulnerability
and to Andrew Tridgell and Martin Pool for their rapid response.
(from Red Hat advisory)
3. Solution:
a) Updating via yup...
We suggest that you use the Yellow Dog Update Program (yup)
to keep your system up-to-date. The following command(s) will
automatically retrieve and install the fixed version of
this update onto your system:
yup update rsync
b) Updating manually...
The update can also be retrieved manually from our ftp site
below along with the rpm command that should be used to install
the update. (Please use a mirror site)
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
rpm -Fvh rsync-2.4.6-8.ppc.rpm
4. Verification
MD5 checksum Package
-------------------------------- ----------------------------
cdb7504ade5757296812a2b0f76d1457 ppc/rsync-2.4.6-8.ppc.rpm
96734cb3b3e235e33f14a19909c97b67 SRPMS/rsync-2.4.6-8.src.rpm
If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename
5. Misc.
Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.
For information regarding the usage of yup, the Yellow Dog Update Program, see
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml
This archive was generated by hypermail 2a24 : Sun Jan 27 2002 - 19:24:18 MST