Sicherheit: Mehrere Probleme in rsync

Lesezeichen hinzufügen

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--OJqd5nfsLgcminjJkAq6GiMgxJVrTzTcs
Content-Type: multipart/mixed;
boundary="lkb4izcyScaK0E6jtx20fO3hBpTp6w8BP";
protected-headers="v1"
From: Mikle Kolyada <zlogene@gentoo.org>
Reply-To: security@gentoo.org
To: gentoo-announce@lists.gentoo.org
Message-ID: <4cc8842e-81e7-9170-ba87-31c8b6eb32e2@gentoo.org>
Subject: [ GLSA 201801-16 ] rsync: Multiple vulnerabilities

--lkb4izcyScaK0E6jtx20fO3hBpTp6w8BP
Content-Type: multipart/alternative;
boundary="------------7CA4C8157D1441AEC68E8246"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------7CA4C8157D1441AEC68E8246
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201801-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: rsync: Multiple vulnerabilities
Date: January 17, 2018
Bugs: #636714, #640570
ID: 201801-16

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in rsync, the worst of which
could allow remote attackers to bypass access restrictions.

Background
==========

File transfer program to keep remote files into sync.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/rsync < 3.1.2-r2 >= 3.1.2-r2

Description
===========

Multiple vulnerabilities have been discovered in rsync. Please review
the CVE identifiers referenced below for details.

Impact
======

A remote attacker could bypass intended access restrictions or cause a
Denial of Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All rsync users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.2-r2"

References
==========

[ 1 ] CVE-2017-16548
https://nvd.nist.gov/vuln/detail/CVE-2017-16548
[ 2 ] CVE-2017-17433
https://nvd.nist.gov/vuln/detail/CVE-2017-17433
[ 3 ] CVE-2017-17434
https://nvd.nist.gov/vuln/detail/CVE-2017-17434

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201801-16

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

--------------7CA4C8157D1441AEC68E8246
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html>
<head>

<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Dutf=
-8">
</head>
<body text=3D"#000000" bgcolor=3D"#FFFFFF">
<pre style=3D"color: rgb(0, 0, 0); font-style: normal;
font-variant-l=
igatures: normal; font-variant-caps: normal; font-weight: 400; letter-spa=
cing: normal; orphans: 2; text-align: start; text-indent: 0px; text-trans=
form: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;=
text-decoration-style: initial; text-decoration-color: initial; word-wra=
p: break-word; white-space: pre-wrap;">- - - - - - - - - - - - - - - - -
=
- - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201801-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
<a
class=3D"moz-txt-link-freet=
ext" href=3D"https://security.gentoo.org/">https://security.gentoo.org/</=
a>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: rsync: Multiple vulnerabilities
Date: January 17, 2018
Bugs: #636714, #640570
ID: 201801-16

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=3D=3D=3D=3D=3D=3D=3D=3D

Multiple vulnerabilities have been found in rsync, the worst of which
could allow remote attackers to bypass access restrictions.

Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

File transfer program to keep remote files into sync.

Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/rsync < 3.1.2-r2 >=3D
3.1.=
2-r2=20

Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Multiple vulnerabilities have been discovered in rsync. Please review
the CVE identifiers referenced below for details.

Impact
=3D=3D=3D=3D=3D=3D

A remote attacker could bypass intended access restrictions or cause a
Denial of Service condition.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

There is no known workaround at this time.

Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

All rsync users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=3Dnet-misc/rsync-3.1.2-r2"

References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

[ 1 ] CVE-2017-16548
<a class=3D"moz-txt-link-freetext" href=3D"https://nvd.nist.gov/vul=
n/detail/CVE-2017-16548">https://nvd.nist.gov/vuln/detail/CVE-2017-16548<=
/a>
[ 2 ] CVE-2017-17433
<a class=3D"moz-txt-link-freetext" href=3D"https://nvd.nist.gov/vul=
n/detail/CVE-2017-17433">https://nvd.nist.gov/vuln/detail/CVE-2017-17433<=
/a>
[ 3 ] CVE-2017-17434
<a class=3D"moz-txt-link-freetext" href=3D"https://nvd.nist.gov/vul=
n/detail/CVE-2017-17434">https://nvd.nist.gov/vuln/detail/CVE-2017-17434<=
/a>

Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

<a class=3D"moz-txt-link-freetext" href=3D"https://security.gentoo.org/g=
lsa/201801-16">https://security.gentoo.org/glsa/201801-16</a>

Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
<a class=3D"moz-txt-link-abbreviated"
href=3D"mailto:security@gentoo.org"=
>security@gentoo.org</a> or alternatively, you may file a bug at
<a class=3D"moz-txt-link-freetext" href=3D"https://bugs.gentoo.org">https=
://bugs.gentoo.org</a>.

License
=3D=3D=3D=3D=3D=3D=3D

Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

<a class=3D"moz-txt-link-freetext" href=3D"https://creativecommons.org/li=
censes/by-sa/2.5">https://creativecommons.org/licenses/by-sa/2.5</a></pre=
>
</body>
</html>

--------------7CA4C8157D1441AEC68E8246--

--lkb4izcyScaK0E6jtx20fO3hBpTp6w8BP--

--OJqd5nfsLgcminjJkAq6GiMgxJVrTzTcs
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iLMEAQEIAB0WIQQ75Qy/x9/HSNkDtdMb3A5axC611gUCWl7DlgAKCRAb3A5axC61
1nH1A/96Y+4WgHDDjAixE8YRz+GuPJLad0PvN/v3YygWbaKqqYuZH3dEv0mNewvf
iCTx53QxcReXyEJQGV7FFSB8h5jS5TVVbmkCOv6mRvtYFztktz883pRMISzLR011
WCuPjk/XmB8FvbAgD25MSfMewRr0CGRvPZKZIBxNJ2QrG8q02w==
=n9P0
-----END PGP SIGNATURE-----

--OJqd5nfsLgcminjJkAq6GiMgxJVrTzTcs--