SUSE-SU-2018:0117-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:0117-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2018:0117-1
Related
Published
2018-01-17T07:32:49Z
Modified
2018-01-17T07:32:49Z
Summary
Security update for rsync
Details

This update for rsync fixes the following issues:

Security issues fixed:

  • CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in the daemonfilterlist data structure (in the recvfiles function in receiver.c) and also did not apply the sanitizepaths protection mechanism to pathnames found in 'xname follows' strings (in the readndxand_attrs function in rsync.c), which allowed remote attackers to bypass intended access restrictions' (bsc#1071460).
  • CVE-2017-17433: The recvfiles function in receiver.c in the daemon in rsync, proceeded with certain file metadata updates before checking for a filename in the daemonfilter_list data structure, which allowed remote attackers to bypass intended access restrictions (bsc#1071459).
  • CVE-2017-16548: The receive_xattr function in xattrs.c in rsync did not check for a trailing '\0' character in an xattr name, which allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon (bsc#1066644).
References

Affected packages

SUSE:Linux Enterprise Server 11 SP4 / rsync

Package

Name
rsync
Purl
purl:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.4-2.53.3.1

Ecosystem specific

{
    "binaries": [
        {
            "rsync": "3.0.4-2.53.3.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 11 SP4 / rsync

Package

Name
rsync
Purl
purl:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.4-2.53.3.1

Ecosystem specific

{
    "binaries": [
        {
            "rsync": "3.0.4-2.53.3.1"
        }
    ]
}