Security update for rsync SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0117-1 Final 1 1 2018-01-17T07:32:49Z current 2018-01-17T07:32:49Z 2018-01-17T07:32:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rsync This update for rsync fixes the following issues: Security issues fixed: - CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also did not apply the sanitize_paths protection mechanism to pathnames found in 'xname follows' strings (in the read_ndx_and_attrs function in rsync.c), which allowed remote attackers to bypass intended access restrictions' (bsc#1071460). - CVE-2017-17433: The recv_files function in receiver.c in the daemon in rsync, proceeded with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allowed remote attackers to bypass intended access restrictions (bsc#1071459). - CVE-2017-16548: The receive_xattr function in xattrs.c in rsync did not check for a trailing '\\0' character in an xattr name, which allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon (bsc#1066644). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-rsync-13416 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180117-1/ Link for SUSE-SU-2018:0117-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003603.html E-Mail link for SUSE-SU-2018:0117-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1066644 SUSE Bug 1066644 https://bugzilla.suse.com/1071459 SUSE Bug 1071459 https://bugzilla.suse.com/1071460 SUSE Bug 1071460 https://www.suse.com/security/cve/CVE-2017-16548/ SUSE CVE CVE-2017-16548 page https://www.suse.com/security/cve/CVE-2017-17433/ SUSE CVE CVE-2017-17433 page https://www.suse.com/security/cve/CVE-2017-17434/ SUSE CVE CVE-2017-17434 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 rsync-3.0.4-2.53.3.1 rsync-3.0.4-2.53.3.1 as a component of SUSE Linux Enterprise Server 11 SP4 rsync-3.0.4-2.53.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon. CVE-2017-16548 SUSE Linux Enterprise Server 11 SP4:rsync-3.0.4-2.53.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:rsync-3.0.4-2.53.3.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180117-1/ https://www.suse.com/security/cve/CVE-2017-16548.html CVE-2017-16548 https://bugzilla.suse.com/1066644 SUSE Bug 1066644 The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions. CVE-2017-17433 SUSE Linux Enterprise Server 11 SP4:rsync-3.0.4-2.53.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:rsync-3.0.4-2.53.3.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180117-1/ https://www.suse.com/security/cve/CVE-2017-17433.html CVE-2017-17433 https://bugzilla.suse.com/1071459 SUSE Bug 1071459 The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions. CVE-2017-17434 SUSE Linux Enterprise Server 11 SP4:rsync-3.0.4-2.53.3.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:rsync-3.0.4-2.53.3.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180117-1/ https://www.suse.com/security/cve/CVE-2017-17434.html CVE-2017-17434 https://bugzilla.suse.com/1071460 SUSE Bug 1071460