Articles by KENNETH

USN-3506-1: rsync vulnerabilities Ubuntu Security Notice USN-3506-1 7th December, 2017 rsync vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.10 Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in rsync. Software description rsync – fast, versatile, remote (and local) file-copying tool Details It was discovered that rsync proceeds with certain file metadata updatesbefore checking for a filename. An attacker could use this to bypass accessrestrictions. (CVE-2017-17433) It was discovered that rsync does not check for fnamecmp filenames and alsodoes not apply the sanitize_paths protection mechanism to pathnames. An attackercould use this to bypass access restrictions. (CVE-2017-17434) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.10: rsync 3.1.2-2ubuntu0.1 Ubuntu 17.04: rsync 3.1.2-1ubuntu0.1 Ubuntu 16.04 LTS: rsync 3.1.1-3ubuntu1.1 Ubuntu 14.04 LTS: rsync [ more… ]

USN-3506-2: rsync vulnerabilities Ubuntu Security Notice USN-3506-2 7th December, 2017 rsync vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTS Summary Several security issues were fixed in rsync. Software description rsync – fast, versatile, remote (and local) file-copying tool Details USN-3506-1 fixed two vulnerabilities in rsync. This update providesthe corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that rsync proceeds with certain file metadata updates before checking for a filename. An attacker could use this to bypass access restrictions. (CVE-2017-17433) It was discovered that rsync does not check for fnamecmp filenames and also does not apply the sanitize_paths protection mechanism to pathnames. An attacker could use this to bypass access restrictions. (CVE-2017-17434) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 12.04 [ more… ]