Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: General :: hack1092.htm

rsync heap based overflow (OpenLinux)
OpenLinux: rsync heap based overflow

Hash: SHA1


			SCO Security Advisory

Subject:		OpenLinux: rsync heap based overflow
Advisory number: 	CSSA-2004-010.0
Issue date: 		2004 March 02
Cross reference:	sr888533 fz528609 erg712514 CAN-2003-0962

1. Problem Description

	Heap-based buffer overflow in rsync before 2.5.7, when running in
	server mode, allows remote attackers to execute arbitrary code
	and possibly escape the chroot jail. 

	The Common Vulnerabilities and Exposures project ( 
	has assigned the name CAN-2003-0962 to this issue.

2. Vulnerable Supported Versions

	System				Package
	OpenLinux 3.1.1 Server		prior to rsync-2.5.7-1.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to rsync-2.5.7-1.i386.rpm

3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.

4. OpenLinux 3.1.1 Server

	4.1 Package Location 0.0/RPMS

	4.2 Packages

	4fb00e592531f020fcb4f42153c27b47	rsync-2.5.7-1.i386.rpm

	4.3 Installation

	rpm -Fvh rsync-2.5.7-1.i386.rpm

	4.4 Source Package Location 0.0/SRPMS

	4.5 Source Packages

	04c03598ea2f99c603933b7a0f1132a3	rsync-2.5.7-1.src.rpm

5. OpenLinux 3.1.1 Workstation

	5.1 Package Location 4-010.0/RPMS

	5.2 Packages

	c2cf07248715486ecb89235a69183eb2	rsync-2.5.7-1.i386.rpm

	5.3 Installation

	rpm -Fvh rsync-2.5.7-1.i386.rpm

	5.4 Source Package Location 4-010.0/SRPMS

	5.5 Source Packages

	eb5c948fd8bb5128230346ac51f48a35	rsync-2.5.7-1.src.rpm

6. References

	Specific references for this advisory: 

	SCO security resources: 

	This security fix closes SCO incidents sr888533 fz528609

7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.

8. Acknowledgements

	SCO would like to thank Mike Warfield, Paul Russell, and  Andrea Barisani 

Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH