BID:17788

RSync Receive_XATTR Integer Overflow Vulnerability

Info

RSync Receive_XATTR Integer Overflow Vulnerability

Bugtraq ID:	17788
Class:	Boundary Condition Error
CVE:	CVE-2006-2083
Remote:	Yes
Local:	No
Published:	May 02 2006 12:00AM
Updated:	May 08 2006 05:14PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 rsync rsync 2.6.7 rsync rsync 2.6.6 + Ubuntu Ubuntu Linux 6.06 LTS sparc + Ubuntu Ubuntu Linux 6.06 LTS powerpc + Ubuntu Ubuntu Linux 6.06 LTS i386 + Ubuntu Ubuntu Linux 6.06 LTS amd64 rsync rsync 2.6.5 rsync rsync 2.6.5 rsync rsync 2.6.2 + OpenPKG OpenPKG 2.1 rsync rsync 2.6.1 rsync rsync 2.6 + OpenPKG OpenPKG 2.0 rsync rsync 2.5.7 rsync rsync 2.5.6 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + OpenBSD OpenBSD 3.4 + OpenBSD OpenBSD 3.3 + OpenBSD OpenBSD 3.2 + OpenBSD OpenBSD 3.1 + OpenBSD OpenBSD 3.0 + OpenPKG OpenPKG 1.3 + OpenPKG OpenPKG 1.2 + OpenPKG OpenPKG Current + Redhat Fedora Core1 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + Slackware Linux 9.1 + Slackware Linux 9.0 rsync rsync 2.5.5 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + Slackware Linux 8.1 + SuSE Linux 8.1 rsync rsync 2.5.4 + Immunix Immunix OS 7.3 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Multi Network Firewall 2.0 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 rsync rsync 2.5.3 rsync rsync 2.5.2 + Immunix Immunix OS 7+ rsync rsync 2.5.1 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.1.1 - FreeBSD FreeBSD 4.1 rsync rsync 2.5 .0 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.1.1 - FreeBSD FreeBSD 4.1 rsync rsync 2.4.8 rsync rsync 2.4.6 + EnGarde Secure Linux 1.0.1 + HP Secure OS software for Linux 1.0 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + SuSE Linux 8.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.2 i386 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 rsync rsync 2.4.5 rsync rsync 2.4.4 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha rsync rsync 2.4.3 + Caldera OpenLinux 3.1 -IA64 + Caldera OpenLinux 2.3 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1 + Trustix Secure Linux 1.1 rsync rsync 2.4.1 + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + Trustix Secure Linux 1.0 1 rsync rsync 2.4 .0 rsync rsync 2.3.2 -1.3 rsync rsync 2.3.2 -1.2 sparc + Debian Linux 2.2 sparc rsync rsync 2.3.2 -1.2 PPC + Debian Linux 2.2 powerpc rsync rsync 2.3.2 -1.2 m68k + Debian Linux 2.2 68k rsync rsync 2.3.2 -1.2 intel + Debian Linux 2.2 IA-32 rsync rsync 2.3.2 -1.2 ARM + Debian Linux 2.2 arm rsync rsync 2.3.2 -1.2 alpha + Debian Linux 2.2 alpha rsync rsync 2.3.2 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 6.4 ppc + SuSE Linux 6.4 i386 + SuSE Linux 6.4 alpha rsync rsync 2.3.1 + Caldera OpenLinux eBuilder 3.0 + SCO eDesktop 2.4 + SCO eServer 2.3.1

Not Vulnerable:	rsync rsync 2.6.8 + Ubuntu Ubuntu Linux 6.10 sparc + Ubuntu Ubuntu Linux 6.10 powerpc + Ubuntu Ubuntu Linux 6.10 i386 + Ubuntu Ubuntu Linux 6.10 amd64

Discussion

RSync Receive_XATTR Integer Overflow Vulnerability

The rsync utility is susceptible to a remote integer-overflow vulnerability. This issue is due to the application's failure to properly ensure that user-supplied input doesn't overflow integer values. This may result in user-supplied data being copied past the end of a memory buffer.

Attackers may exploit this issue to execute arbitrary machine code in the context of the affected application, facilitating in the compromise of affected computers.

Versions of rsync prior to 2.6.8 that have had the 'xattrs.diff' patch applied are vulnerable to this issue.

Exploit / POC

RSync Receive_XATTR Integer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Solution / Fix

RSync Receive_XATTR Integer Overflow Vulnerability

Solution:
The vendor has released version 2.6.8 of rsync, which includes a fixed version of the 'xattrs.diff' patch to address this issue.

Please see the referenced vendor advisories for further information.

rsync rsync 2.3.1