|
 |
| Problem Description |
rsync before 3.0.0pre6, when running a writable rsync daemon that is
not using chroot, allows remote attackers to access restricted files
via unknown vectors that cause rsync to create a symlink that points
outside of the module's hierarchy. (CVE-2007-6199)
Unspecified vulnerability in rsync before 3.0.0pre6, when running a
writable rsync daemon, allows remote attackers to bypass exclude,
exclude_from, and filter and read or write hidden files via (1)
symlink, (2) partial-dir, (3) backup-dir, and unspecified (4) dest
options. (CVE-2007-6200)
This update fixes these issues. It is recommended users (specially
system and network administrators) read the manpage about the
introduced munge symlinks feature.
This update also upgrades rsync to version 2.6.9 for all Mandriva
Linux versions earlier than 2008.0.
| Updated Packages |
Corporate Server 3.0
7949dd695db813c06f9fc7db853864f8 corporate/3.0/i586/rsync-2.6.9-0.1.C30mdk.i586.rpm 21df68a34ef7732f1a0685d850ceb46d corporate/3.0/SRPMS/rsync-2.6.9-0.1.C30mdk.src.rpm
Corporate Server 3.0/X86_64
5a4327131d15f9b008b32471eac47877 corporate/3.0/x86_64/rsync-2.6.9-0.1.C30mdk.x86_64.rpm 21df68a34ef7732f1a0685d850ceb46d corporate/3.0/SRPMS/rsync-2.6.9-0.1.C30mdk.src.rpm
Mandriva Linux 2007
fdea773146cff55a58e6c021a411d0d9 2007.0/i586/rsync-2.6.9-0.1mdv2007.0.i586.rpm 93afe1627418872e14aacf9ee2ed4d18 2007.0/SRPMS/rsync-2.6.9-0.1mdv2007.0.src.rpm
Mandriva Linux 2007/X86_64
d9f0b368c1432feba67f51f5d4053d06 2007.0/x86_64/rsync-2.6.9-0.1mdv2007.0.x86_64.rpm 93afe1627418872e14aacf9ee2ed4d18 2007.0/SRPMS/rsync-2.6.9-0.1mdv2007.0.src.rpm
Corporate Server 4.0
36f429d7b5f59514b357739cfa022058 corporate/4.0/i586/rsync-2.6.9-0.1.20060mlcs4.i586.rpm 522dab65e48a0d2ce46d7bd29374c5ce corporate/4.0/SRPMS/rsync-2.6.9-0.1.20060mlcs4.src.rpm
Corporate Server 4.0/X86_64
2c57404df93fae7ac16e27f15bf1cc16 corporate/4.0/x86_64/rsync-2.6.9-0.1.20060mlcs4.x86_64.rpm 522dab65e48a0d2ce46d7bd29374c5ce corporate/4.0/SRPMS/rsync-2.6.9-0.1.20060mlcs4.src.rpm
Mandriva Linux 2007.1
62323582b53e066d60edd4a38c0edcee 2007.1/i586/rsync-2.6.9-1.2mdv2007.1.i586.rpm b4e0a376cd14cc27d6006f3844e1b576 2007.1/SRPMS/rsync-2.6.9-1.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64
3f710d1bfb189380264dd57a701b069a 2007.1/x86_64/rsync-2.6.9-1.2mdv2007.1.x86_64.rpm b4e0a376cd14cc27d6006f3844e1b576 2007.1/SRPMS/rsync-2.6.9-1.2mdv2007.1.src.rpm
Mandriva Linux 2008.0
55755e81158e1664c48ae5fa69130ca1 2008.0/i586/rsync-2.6.9-5.1mdv2008.0.i586.rpm e161a0b5150e3d74f8671dbf0aa9e2aa 2008.0/SRPMS/rsync-2.6.9-5.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64
df57566d88efb9493b6f417c562d5e3f 2008.0/x86_64/rsync-2.6.9-5.1mdv2008.0.x86_64.rpm e161a0b5150e3d74f8671dbf0aa9e2aa 2008.0/SRPMS/rsync-2.6.9-5.1mdv2008.0.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6200
http://rsync.samba.org/security.html#s3_0_0
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.