From please_reply_to_security@sco.com Wed Mar 3 17:11:18 2004 From: please_reply_to_security@sco.com To: announce@lists.caldera.com, bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, security-alerts@linuxsecurity.com Date: Tue, 2 Mar 2004 19:33:57 -0800 (PST) Subject: OpenLinux: rsync heap based overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: OpenLinux: rsync heap based overflow Advisory number: CSSA-2004-010.0 Issue date: 2004 March 02 Cross reference: sr888533 fz528609 erg712514 CAN-2003-0962 ______________________________________________________________________________ 1. Problem Description Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0962 to this issue. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to rsync-2.5.7-1.i386.rpm OpenLinux 3.1.1 Workstation prior to rsync-2.5.7-1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-010.0/RPMS 4.2 Packages 4fb00e592531f020fcb4f42153c27b47 rsync-2.5.7-1.i386.rpm 4.3 Installation rpm -Fvh rsync-2.5.7-1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-010.0/SRPMS 4.5 Source Packages 04c03598ea2f99c603933b7a0f1132a3 rsync-2.5.7-1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-010.0/RPMS 5.2 Packages c2cf07248715486ecb89235a69183eb2 rsync-2.5.7-1.i386.rpm 5.3 Installation rpm -Fvh rsync-2.5.7-1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-010.0/SRPMS 5.5 Source Packages eb5c948fd8bb5128230346ac51f48a35 rsync-2.5.7-1.src.rpm 6. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0962 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr888533 fz528609 erg712514. 7. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 8. Acknowledgements SCO would like to thank Mike Warfield, Paul Russell, and Andrea Barisani ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (SCO/UNIX_SVR5) iD8DBQFARUytbluZssSXDTERAs86AJwMNzvIj54GMsSDhYxJKY6tBGSPNACfWwXE QW+REMhisLAnfD784BsdlCo= =Ueoz -----END PGP SIGNATURE-----