FS#8164 - Security bug in rsync

Attached to Project: Arch Linux
Opened by Hussam Al-Tayeb (hussam) - Saturday, 29 September 2007, 21:57 GMT
Last edited by Tobias Powalowski (tpowa) - Sunday, 30 September 2007, 10:59 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To Tobias Powalowski (tpowa)
Architecture All
Severity High
Priority Normal
Reported Version 2007.08.1
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4091

"Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function. "

I'll attach the suse fix.
This task depends upon

Closed by  Tobias Powalowski (tpowa)
Sunday, 30 September 2007, 10:59 GMT
Reason for closing:  Fixed
Comment by Hussam Al-Tayeb (hussam) - Saturday, 29 September 2007, 21:58 GMT
Attached suse fix for this issue.
   rsync-2.6.9-fname-obo.diff (1.3 KiB)

Loading...