- Name of Program: [USN-1124-1] rsync vulnerability
- Developer website:
- Thread: Low
rsync could be made to crash or run programs as your login if it connected to a malicious server.
It was discovered that rsync incorrectly handled memory when certain recursion, deletion and ownership options were used. If a user were tricked into connecting to a malicious server, a remote attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 9.10
The problem can be corrected by updating your system to the following package versions:
- Ubuntu 10.10: rsync 3.0.7-2ubuntu1.1
- Ubuntu 10.04 LTS: rsync 3.0.7-1ubuntu1.1
- Ubuntu 9.10: rsync 3.0.6-1ubuntu1.1
In general, a standard system update will make all the necessary changes.