Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » EnGarde - ESA-20020125-004 - rsync

EnGarde - ESA-20020125-004 - rsync

by Nikola Strahija on January 27th, 2002 There are instances where rsync does not do proper input validation, allowing an attacker to write NULL-bytes to somewhat arbitrary locations of the stack. This may potentially lead to a remote root shell.


EnGarde Secure Linux Security Advisory January 25, 2002
http://www.engardelinux.org/ ESA-20020125-004
Package: rsync
Summary: signed integer handling vulnerability


EnGarde Secure Linux is a secure distribution of Linux that features
improved access control, host and network intrusion detection, Web
based secure remote management, complete e-commerce using AllCommerce,
and integrated open source security tools.


OVERVIEW
---------
There is a signed integer handling vulnerability in rsync which can
allow an attacker to potentially gain root access.


DETAIL
-------
There are instances where rsync does not do proper input validation,
allowing an attacker to write NULL-bytes to somewhat arbitrary locations
of the stack. This may potentially lead to a remote root shell.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0048 to this issue.


SOLUTION
---------
This information applies only to EnGarde Secure Linux Community edition
users. Registered users of the EnGarde Secure Linux Professional
edition can use the Guardian Digital Secure Network to upgrade their
packages automatically.

All users should upgrade to the most recent version as outlined in
this advisory. All updates may be found at:

ftp://ftp.engardelinux.org/pub/engarde/stable/updates/
http://ftp.engardelinux.org/pub/engarde/stable/updates/

Before upgrading the package, the machine must either:

a) be booted into a "standard" kernel; or
b) have LIDS disabled.

To disable LIDS, execute the command:

# /sbin/lidsadm -S -- -LIDS_GLOBAL

To install the updated package, execute the command:

# rpm -Uvh

You must now update the LIDS configuration by executing the command:

# /usr/sbin/config_lids.pl

To re-enable LIDS (if it was disabled), execute the command:

# /sbin/lidsadm -S -- +LIDS_GLOBAL

To verify the signatures of the updated packages, execute the command:

# rpm -Kv


UPDATED PACKAGES
-----------------
These updated packages are for EnGarde Secure Linux 1.0.1 (Finestra).

Source Packages:

SRPMS/rsync-2.4.6-1.0.3.src.rpm
MD5 Sum: 0d327ed5799c5407df49aa63e1611592

Binary Packages:

i386/rsync-2.4.6-1.0.3.i386.rpm
MD5 Sum: 130608e7f4d1600d8ceb47ad7fe7c4ce

i686/rsync-2.4.6-1.0.3.i686.rpm
MD5 Sum: 17dea017e1991234eed30aea4248c479


REFERENCES
-----------

Guardian Digital's public key:
http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY

CVE Name CAN-2002-0048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0048

Credit for the discovery of this bug goes to:
Sebastian Krahmer

rsync's Official Web Site:
http://rsync.samba.org

Security Contact: [email protected]
EnGarde Advisories: http://www.engardelinux.org/advisories.html

---------------------------------------------------------------------------
$Id: ESA-20020125-004-rsync,v 1.1 2002/01/25 16:04:36 rwm Exp $
---------------------------------------------------------------------------
Author: Ryan W. Maple,
Copyright 2002, Guardian Digital, Inc.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »