rsync: Integer overflow in the receive_xattr function (remote exploit)

Debian Bug report logs - #365614
rsync: Integer overflow in the receive_xattr function (remote exploit)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jay Kline <jay@ahpcrc.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: rsync: Integer overflow in the receive_xattr function (remote exploit)

Date: Mon, 01 May 2006 08:34:22 -0500

Package: rsync
Version: 2.6.4-6
Severity: grave
Tags: security
Justification: user security hole


Integer overflow in the receive_xattr function in the extended
attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers
to execute arbitrary code via crafted extended attributes that trigger a
buffer overflow.

See http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-2083 for more details.


-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.11-1-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages rsync depends on:
ii  libc6                 2.3.2.ds1-22sarge3 GNU C Library: Shared libraries an
ii  libpopt0              1.7-5              lib for parsing cmdline parameters

-- no debconf information

Message #10 received at 365614@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: Jay Kline <jay@ahpcrc.org>, 365614@bugs.debian.org

Subject: Re: Bug#365614: rsync: Integer overflow in the receive_xattr function (remote exploit)

Date: Mon, 1 May 2006 17:03:01 +0200

On Mon 01 May 2006, Jay Kline wrote:

> Package: rsync
> Version: 2.6.4-6
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> 
> Integer overflow in the receive_xattr function in the extended
> attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers
> to execute arbitrary code via crafted extended attributes that trigger a
> buffer overflow.

Do you have reason to believe that Debian's rsync 2.6.4-6 has that patch
applied?


Paul Slootman

Message #15 received at 365614-done@bugs.debian.org (full text, mbox, reply):

From: Paul Slootman <paul@debian.org>

To: Jay Kline <jay@ahpcrc.org>

Cc: 365614-done@bugs.debian.org

Subject: Re: Bug#365614: rsync: Integer overflow in the receive_xattr function (remote exploit)

Date: Mon, 1 May 2006 17:12:28 +0200

On Mon 01 May 2006, Jay Kline wrote:
> Paul Slootman wrote:
> > On Mon 01 May 2006, Jay Kline wrote:
> > 
> > 
> >>Package: rsync
> >>Version: 2.6.4-6
> >>Severity: grave
> >>Tags: security
> >>Justification: user security hole
> >>
> >>
> >>Integer overflow in the receive_xattr function in the extended
> >>attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers
> >>to execute arbitrary code via crafted extended attributes that trigger a
> >>buffer overflow.
> > 
> > 
> > Do you have reason to believe that Debian's rsync 2.6.4-6 has that patch
> > applied?
> > 
> 
> Sorry- my mistake.  The way it was worded I thought upstream added that.

In fact, my research shows that the xattrs (optional, experimental!)
patch was first added in 2.6.7, so 2.6.4 can hardly be affected.

Thanks for your concern, but please take a moment to check the facts
before panicing :)


Paul Slootman

Send a report that this bug log contains spam.