Fedora Legacy Test Update Notification: rsync

[Marc Deslauriers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2004-2003
Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2003
2004-09-29
- ---------------------------------------------------------------------

Name        : rsync
Versions    : 7.3: 2.5.7-2.legacy.7x, 9: 2.5.7-2.legacy.9
Summary     : A program for synchronizing files over a network.
Description : 
Rsync uses a reliable algorithm to bring remote and host files into
sync very quickly. Rsync is fast because it just sends the differences
in the files over the network instead of sending the complete
files. Rsync is often used as a very powerful mirroring process or
just as a more capable replacement for the rcp command. A technical
report which describes the rsync algorithm is included in this
package.

- ---------------------------------------------------------------------
Update Information:

Rsync before 2.6.1 does not properly sanitize paths when running a
read/write daemon without using chroot. This could allow a remote
attacker
to write files outside of the module's "path", depending on the
privileges
assigned to the rsync daemon. Users not running an rsync daemon, running
a
read-only daemon, or running a chrooted daemon are not affected by this
issue. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0426 to this issue.

Versions of rsync up to and including version 2.6.2 contain a path
sanitization issue. This issue could allow an attacker to read or write
files outside of the rsync directory. This vulnerability is only
exploitable when an rsync server is enabled and is not running within a
chroot. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0792 to this issue.

- ---------------------------------------------------------------------
7.3 changelog:
* Mon Aug 30 2004 Dave Botsch <dwb7 at ccmr.cornell.edu> 2.5.7-2.legacy.7x
 
- - apply sanitize patch for CAN-2004-0792
- - rsync path sanitizing bug
 
* Wed May 05 2004 Seth Vidal <skvidal at phy.duke.edu> 2.5.7-1.legacy.7x
 
- - apply sanitize path's patch for:
- - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0426
- - Fix for segfault when RSYNC_PROXY port part is too long

9 changelog:
* Wed Sep 01 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.5.7-2.legacy.9
 
- - apply sanitize patch for CAN-2004-0792
- - rsync path sanitizing bug
 
* Tue May 04 2004 Rok Papez <rok.papez at lugos.si> 2.5.7-1.legacy.9
 
- - Fix for segfault when RSYNC_PROXY port part is too long
- - Fix for CAN-2004-0426: not properly sanitizing paths

- ---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/redhat/
(sha1sums)

1101ad1c735a11c9be6f4d45971374a6195431d9
7.3/updates-testing/i386/rsync-2.5.7-2.legacy.7x.i386.rpm
4bb344d823f423cf5c1cc64d949dd1d9408960e7
7.3/updates-testing/SRPMS/rsync-2.5.7-2.legacy.7x.src.rpm
49a3fa2fe967ed5c62994d5785463357aaf49de5
9/updates-testing/i386/rsync-2.5.7-2.legacy.9.i386.rpm
84ec22198c189660f3cf2b967b710de9a04d6b22
9/updates-testing/SRPMS/rsync-2.5.7-2.legacy.9.src.rpm

- ---------------------------------------------------------------------

Please test and comment in bugzilla.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBWoyBLMAs/0C4zNoRAv19AKCH/vj9j5lGDLW4Abyhz4IAMI68HQCgwyuZ
n3lwL6V0irPwag+g2uGDRmY=
=SBxz
-----END PGP SIGNATURE-----