Your message dated Mon, 1 May 2006 17:12:28 +0200
with message-id <[EMAIL PROTECTED]>
and subject line Bug#365614: rsync: Integer overflow in the receive_xattr
function (remote exploit)
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: rsync
Version: 2.6.4-6
Severity: grave
Tags: security
Justification: user security hole
Integer overflow in the receive_xattr function in the extended
attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers
to execute arbitrary code via crafted extended attributes that trigger a
buffer overflow.
See http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-2083 for more details.
-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.11-1-686
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages rsync depends on:
ii libc6 2.3.2.ds1-22sarge3 GNU C Library: Shared libraries an
ii libpopt0 1.7-5 lib for parsing cmdline parameters
-- no debconf information
--- End Message ---
--- Begin Message ---
On Mon 01 May 2006, Jay Kline wrote:
> Paul Slootman wrote:
> > On Mon 01 May 2006, Jay Kline wrote:
> >
> >
> >>Package: rsync
> >>Version: 2.6.4-6
> >>Severity: grave
> >>Tags: security
> >>Justification: user security hole
> >>
> >>
> >>Integer overflow in the receive_xattr function in the extended
> >>attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers
> >>to execute arbitrary code via crafted extended attributes that trigger a
> >>buffer overflow.
> >
> >
> > Do you have reason to believe that Debian's rsync 2.6.4-6 has that patch
> > applied?
> >
>
> Sorry- my mistake. The way it was worded I thought upstream added that.
In fact, my research shows that the xattrs (optional, experimental!)
patch was first added in 2.6.7, so 2.6.4 can hardly be affected.
Thanks for your concern, but please take a moment to check the facts
before panicing :)
Paul Slootman
--- End Message ---
