Due to an unspecified boundary error in the rsync server, a remote attacker can execute remote commands via a heap overflow. If exploited, the attacker could run commands as the same UID the rsync server runs under.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Exploit:
Exploit Unknown
Disclosure:
Vendor Verified,
Discovered in the Wild
Solution
Upgrade to version 2.5.7 or higher, as it has been reported to fix this vulnerability. Disabling the rsync server service completely is a temporary workaround.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
