Overview
There exist several signed-integer vulnerabilities in rsync. If rsync is run as a daemon, a remote-root compromise may be possible.
Description
Included in most distributions of Linux, rsync is a popular tool for synchronizing files across multiple hosts. Though not enabled in the default configuration, rsync can be run as a daemon to facilitate the distribution of files to FTP mirror sites. Researchers have found several vulnerabilities in rsync, resulting from the use of signed integer variables. If rsync receives negative integers where it expects positive integers, it can forced to overwrite arbitrary bytes of the stack with zeroes (null-bytes). |
Impact
The rsync process can be used to exploited to execute arbitrary code. If rsync is run as a daemon, a remote attacker can execute arbitrary code as the owner of the rsync process, generally root. |
Solution
Apply a patch from your vendor. |
Use the "chroot" option in the rsync config file to limit rsync's access to the filesystem. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Conectiva for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | CVE-2002-0048 |
| Severity Metric: | 15.26 |
| Date Public: | 2002-01-25 |
| Date First Published: | 2002-09-16 |
| Date Last Updated: | 2002-09-16 21:26 UTC |
| Document Revision: | 11 |