Multiple vulnerabilities have been found in rsync, the worst of which could result in privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.4.3 | >= 3.4.3 |
rsync is a server and client utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree.
Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.4.3"
Multiple vulnerabilities have been discovered in rsync, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.3.0-r2 | >= 3.3.0-r2 |
rsync is a server and client utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree.
Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.3.0-r2"
Multiple vulnerabilities have been discovered in rsync, the worst of which can lead to denial of service or information disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.2.5_pre1 | >= 3.2.5_pre1 |
rsync is a server and client utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree.
Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.2.5_pre1"
Multiple vulnerabilities have been found in rsync, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.2.0 | >= 3.2.0 |
File transfer program to keep remote files into sync.
Multiple vulnerabilities have been discovered in rsync (within bundled zlib). Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.2.0"
A vulnerability in rsync might allow remote attackers to execute arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.1.3 | >= 3.1.3 |
File transfer program to keep remote files into sync.
A vulnerability was discovered in rsync’s parse_arguments function in options.c.
Remote attackers could possibly execute arbitrary commands with the privilege of the process.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.3"
Multiple vulnerabilities have been found in rsync, the worst of which could allow remote attackers to bypass access restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.1.2-r2 | >= 3.1.2-r2 |
File transfer program to keep remote files into sync.
Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details.
A remote attacker could bypass intended access restrictions or cause a Denial of Service condition.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.2-r2"
Multiple vulnerabilities have been found in rsync, the worst of which could allow remote attackers to write arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 3.1.2 | >= 3.1.2 |
File transfer program to keep remote files into sync.
Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below for details.
Remote attackers could write arbitrary files via symlink attacks.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.2"
This GLSA contains notification of vulnerabilities found in several Gentoo packages which have been fixed prior to January 1, 2012. The worst of these vulnerabilities could lead to local privilege escalation and remote code execution. Please see the package list and CVE identifiers below for more information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/syslog-ng | * | < 3.2.4 | >= 3.2.4 |
| app-misc/ca-certificates | * | < 20110502-r1 | >= 20110502-r1 |
| app-office/gnucash | * | < 2.4.4 | >= 2.4.4 |
| dev-db/unixODBC | * | < 2.3.0-r1 | >= 2.3.0-r1 |
| dev-libs/xmlsec | * | < 1.2.17 | >= 1.2.17 |
| dev-php/PEAR-Mail | * | < 1.2.0 | >= 1.2.0 |
| dev-php/PEAR-PEAR | * | < 1.9.2-r1 | >= 1.9.2-r1 |
| dev-util/oprofile | * | < 0.9.6-r1 | >= 0.9.6-r1 |
| dev-util/qt-creator | * | < 2.1.0 | >= 2.1.0 |
| dev-vcs/gitolite | * | < 1.5.9.1 | >= 1.5.9.1 |
| games-sports/racer-bin | * | >= 0.5.0-r1 | — |
| gnome-base/gdm | * | < 3.8.4-r3 | >= 3.8.4-r3 |
| media-libs/fmod | * | < 4.38.00 | >= 4.38.00 |
| media-libs/xine-lib | * | < 1.1.19 | >= 1.1.19 |
| media-sound/lastfmplayer | * | < 1.5.4.26862-r3 | >= 1.5.4.26862-r3 |
| net-analyzer/sflowtool | * | < 3.20 | >= 3.20 |
| net-libs/libsoup | * | < 2.34.3 | >= 2.34.3 |
| net-libs/webkit-gtk | * | < 1.2.7 | >= 1.2.7 |
| net-misc/mrouted | * | < 3.9.5 | >= 3.9.5 |
| net-misc/rsync | * | < 3.0.8 | >= 3.0.8 |
| net-misc/vino | * | < 2.32.2 | >= 2.32.2 |
| sys-apps/shadow | * | < 4.1.4.3 | >= 4.1.4.3 |
| sys-cluster/resource-agents | * | < 1.0.4-r1 | >= 1.0.4-r1 |
| sys-fs/lvm2 | * | < 2.02.72 | >= 2.02.72 |
| x11-apps/xrdb | * | < 1.0.9 | >= 1.0.9 |
For more information on the packages listed in this GLSA, please see their homepage referenced in the ebuild.
Vulnerabilities have been discovered in the packages listed below. Please review the CVE identifiers in the Reference section for details.
A context-dependent attacker may be able to gain escalated privileges, execute arbitrary code, cause Denial of Service, obtain sensitive information, or otherwise bypass security restrictions.
There are no known workarounds at this time.
All FMOD Studio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/fmod-4.38.00"
All PEAR Mail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Mail-1.2.0"
All LVM2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-fs/lvm2-2.02.72"
All GnuCash users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-office/gnucash-2.4.4"
All xine-lib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.19"
All Last.fm Scrobbler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/lastfmplayer-1.5.4.26862-r3"
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-1.2.7"
All shadow tool suite users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/shadow-4.1.4.3"
All PEAR users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-php/PEAR-PEAR-1.9.2-r1"
All unixODBC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/unixODBC-2.3.0-r1"
All Resource Agents users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-cluster/resource-agents-1.0.4-r1"
All mrouted users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/mrouted-3.9.5"
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.0.8"
All XML Security Library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/xmlsec-1.2.17"
All xrdb users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xrdb-1.0.9"
All Vino users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/vino-2.32.2"
All OProfile users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/oprofile-0.9.6-r1"
All syslog-ng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/syslog-ng-3.2.4"
All sFlow Toolkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/sflowtool-3.20"
All GNOME Display Manager users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=gnome-base/gdm-3.8.4-r3"
All libsoup users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libsoup-2.34.3"
All CA Certificates users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20110502-r1"
All Gitolite users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/gitolite-1.5.9.1"
All QtCreator users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/qt-creator-2.1.0"
Gentoo has discontinued support for Racer. We recommend that users unmerge Racer:
# emerge --unmerge "games-sports/racer-bin"
NOTE: This is a legacy GLSA. Updates for all affected architectures have been available since 2012. It is likely that your system is already no longer affected by these issues.
A buffer overflow in rsync might lead to the remote execution of arbitrary code when extended attributes are being used.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 2.6.9-r6 | >= 2.6.9-r6 |
rsync is a file transfer program to keep remote directories synchronized.
Sebastian Krahmer of SUSE reported an integer overflow in the expand_item_list() function in the file util.c which might lead to a heap-based buffer overflow when extended attribute (xattr) support is enabled.
A remote attacker could send a file containing specially crafted extended attributes to an rsync deamon, or entice a user to sync from an rsync server containing specially crafted files, possibly leading to the execution of arbitrary code.
Please note that extended attributes are only enabled when USE="acl" is enabled, which is the default setting.
Disable extended attributes in the rsync daemon by setting "refuse options = xattrs" in the file "/etc/rsyncd.conf" (or append "xattrs" to an existing "refuse" statement). When synchronizing to a server, do not provide the "-X" parameter to rsync. You can also disable the "acl" USE flag for rsync and recompile the package.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-2.6.9-r6"
Two user-assisted buffer overflow vulnerabilities have been discovered in rsync.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 2.6.9-r3 | >= 2.6.9-r3 |
rsync is a file transfer program to keep remote directories synchronized.
Sebastian Krahmer from the SUSE Security Team discovered two off-by-one errors in the function "f_name()" in file sender.c when processing overly long directory names.
A remote attacker could entice a user to synchronize a repository containing specially crafted directories, leading to the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-2.6.9-r3"
An attacker having write access to an rsync module might be able to execute arbitrary code on an rsync server.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 2.6.8 | >= 2.6.8 |
rsync is a server and client utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree.
An integer overflow was found in the receive_xattr function from the extended attributes patch (xattr.c) for rsync. The vulnerable function is only present when the "acl" USE flag is set.
A remote attacker with write access to an rsync module could craft malicious extended attributes which would trigger the integer overflow, potentially resulting in the execution of arbitrary code with the rights of the rsync daemon.
Do not provide write access to an rsync module to untrusted parties.
All rsync users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/rsync-2.6.8"
rsync fails to properly sanitize paths. This vulnerability could allow the listing of arbitrary files and allow file overwriting outside module's path on rsync server configurations that allow uploading.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | <= 2.6.0-r2 | >= 2.6.0-r3 |
rsync is a utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree. rsyncd is the rsync daemon, which listens to connections from rsync clients.
The paths sent by the rsync client are not checked thoroughly enough. It does not affect the normal send/receive filenames that specify what files should be transferred. It does affect certain option paths that cause auxilliary files to be read or written.
When rsyncd is used without chroot ("use chroot = false" in the rsyncd.conf file), this vulnerability could allow the listing of arbitrary files outside module's path and allow file overwriting outside module's path on rsync server configurations that allows uploading. Both possibilities are exposed only when chroot option is disabled.
You should never set the rsync daemon to run with "use chroot = false".
All users should update to the latest version of the rsync package.
# emerge sync # emerge -pv ">=net-misc/rsync-2.6.0-r3" # emerge ">=net-misc/rsync-2.6.0-r3"
Under specific conditions, the rsync daemon is vulnerable to a directory traversal allowing to write files outside a sync module.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | <= 2.6.0-r1 | >= 2.6.0-r2 |
rsync is a utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree. rsyncd is the rsync daemon, which listens to connections from rsync clients.
When rsyncd is used without chroot ("use chroot = false" in the rsyncd.conf file), the paths sent by the client are not checked thoroughly enough. If rsyncd is used with read-write permissions ("read only = false"), this vulnerability can be used to write files anywhere with the rights of the rsyncd daemon. With default Gentoo installations, rsyncd runs in a chroot, without write permissions and with the rights of the "nobody" user.
On affected configurations and if the rsync daemon runs under a privileged user, a remote client can exploit this vulnerability to completely compromise the host.
You should never set the rsync daemon to run with "use chroot = false". If for some reason you have to run rsyncd without a chroot, then you should not set "read only = false".
All users should update to the latest version of the rsync package.
# emerge sync # emerge -pv ">=net-misc/rsync-2.6.0-r2" # emerge ">=net-misc/rsync-2.6.0-r2"
rsync contains a heap overflow vulnerability that can be used to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/rsync | * | < 2.5.7 | >= 2.5.7 |
rsync is a popular file transfer package used to synchronize the Portage tree.
Rsync version 2.5.6 contains a vulnerability that can be used to run arbitrary code. The Gentoo infrastructure team has some reasonably good forensic evidence that this exploit may have been used in combination with the Linux kernel do_brk() vulnerability (see GLSA 200312-02) to exploit a rsync.gentoo.org rotation server (see GLSA-200312-01.)
Please see http://lwn.net/Articles/61541/ for the security advisory released by the rsync development team.
A remote attacker could execute arbitrary code with the permissions of the root user.
There is no known workaround at this time.
To address this vulnerability, all Gentoo users should read GLSA-200312-02 and ensure that all systems are upgraded to a version of the Linux kernel without the do_brk() vulnerability, and upgrade to version 2.5.7 of rsync:
# emerge sync # emerge -pv '>=net-misc/rsync-2.5.7' # emerge '>=net-misc/rsync-2.5.7' # emerge clean
Review your /etc/rsync/rsyncd.conf configuration file; ensure that the use chroot="no" command is commented out or removed, or change use chroot="no" to use chroot="yes". Then, if necessary, restart rsyncd:
# /etc/init.d/rsyncd restart