Having not found any mention of this in the forum I thought I's pass this along for those running rsync on their e-smith.
As read from
http://www.symantec.com/avcenter/security/Content/1425index.html:
Linux rsync I/O errors allow DoS or root access
Risk
HIGH
Date Discovered
01-25-2002
Description
The rsync utility contains several signed/unsigned integer errors in its I/O functions that are remotely exploitable to cause denial of service or, possibly, to gain a root shell on the targeted system.
rsync is an open source utility that allows rapid, incremental file transfer. Frequently, rsync is used to mirror directory structures across computers.
Symantec Corporation is aware of multiple signedness errors (mixed signed and unsigned intergers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions. These errors are remotely exploitable. By supplying improperly checked signed values as an array index, a remote intruder can write NULL bytes to remote memory locations and corrupt the stack. This vulnerability can lead to a crash of the rsync server or client, or allow the remote intruder to execute arbitrary code on the targeted server as the root user.
In some cases, earlier patches to correct the rsync problem contained an error. All versions should be upgaded with the latest patch.
--------------
I understand 512 to use rsync-2.4.6.
Aaron
0 Replies
980 Views