SPECIAL STATE PROTECTION SERVICE
SPECIAL COMMUNICATION AND INFORMATION
SECURITY STATE AGENCY

COMPUTER EMERGENCY
RESPONSE CENTER

Report Incident

Bugtrack

  • Name of Program: [USN-1124-1] rsync vulnerability
  • Developer website:
  • Thread: Low
  • Overview:

    rsync could be made to crash or run programs as your login if it connected to a malicious server.

    It was discovered that rsync incorrectly handled memory when certain recursion, deletion and ownership options were used. If a user were tricked into connecting to a malicious server, a remote attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.

    A security issue affects these releases of Ubuntu and its derivatives:

    • Ubuntu 10.10
    • Ubuntu 10.04 LTS
    • Ubuntu 9.10
  • Solution:

     The problem can be corrected by updating your system to the following package versions:

    • Ubuntu 10.10: rsync 3.0.7-2ubuntu1.1
    • Ubuntu 10.04 LTS: rsync 3.0.7-1ubuntu1.1
    • Ubuntu 9.10: rsync 3.0.6-1ubuntu1.1

    In general, a standard system update will make all the necessary changes.