Test ID:	1.3.6.1.4.1.25623.1.0.54509
Category:	Gentoo Local Security Checks
Title:	Gentoo Security Advisory GLSA 200312-03 (rsync)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory GLSA 200312-03. rsync contains a heap overflow vulnerability that can be used to execute arbitrary code. Solution: To address this vulnerability, all Gentoo users should read GLSA-200312-02 and ensure that all systems are upgraded to a version of the Linux kernel without the do_brk() vulnerability, and upgrade to version 2.5.7 of rsync: # emerge sync # emerge -pv '>=net-misc/rsync-2.5.7' # emerge '>=net-misc/rsync-2.5.7' # emerge clean Review your /etc/rsync/rsyncd.conf configuration file ensure that the use chroot='no' command is commented out or removed, or change use chroot='no' to use chroot='yes'. Then, if necessary, restart rsyncd: # /etc/init.d/rsyncd restart http://www.securityspace.com/smysecure/catid.html?in=GLSA%20200312-03 http://rsync.samba.org/#security_dec03 http://security.gentoo.org/glsa/glsa-200312-02.xml http://security.gentoo.org/glsa/glsa-200312-01.xml CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	BugTraq ID: 9153 Common Vulnerability Exposure (CVE) ID: CVE-2003-0962 http://www.securityfocus.com/bid/9153 Bugtraq: 20031204 GLSA: exploitable heap overflow in rsync (200312-03) (Google Search) http://marc.info/?l=bugtraq&m=107056923528423&w=2 Bugtraq: 20031204 [OpenPKG-SA-2003.051] OpenPKG Security Advisory (rsync) (Google Search) http://marc.info/?l=bugtraq&m=107055702911867&w=2 Bugtraq: 20031204 rsync security advisory (fwd) (Google Search) http://marc.info/?l=bugtraq&m=107055681311602&w=2 CERT/CC vulnerability note: VU#325603 http://www.kb.cert.org/vuls/id/325603 Conectiva Linux advisory: CLA-2003:794 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000794 Debian Security Information: DSA-404 (Google Search) En Garde Linux Advisory: ESA-20031204-032 Immunix Linux Advisory: IMNX-2003-73-001-01 http://www.mandriva.com/security/advisories?name=MDKSA-2003:111 http://www.osvdb.org/2898 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9415 http://www.redhat.com/support/errata/RHSA-2003-398.html http://secunia.com/advisories/10353 http://secunia.com/advisories/10354 http://secunia.com/advisories/10355 http://secunia.com/advisories/10356 http://secunia.com/advisories/10357 http://secunia.com/advisories/10358 http://secunia.com/advisories/10359 http://secunia.com/advisories/10360 http://secunia.com/advisories/10361 http://secunia.com/advisories/10362 http://secunia.com/advisories/10363 http://secunia.com/advisories/10364 http://secunia.com/advisories/10378 http://secunia.com/advisories/10474 SGI Security Advisory: 20031202-01-U ftp://patches.sgi.com/support/free/security/advisories/20031202-01-U SuSE Security Announcement: SuSE-SA:2003:050 (Google Search) http://marc.info/?l=bugtraq&m=107055684711629&w=2 XForce ISS Database: linux-rsync-heap-overflow(13899) https://exchange.xforce.ibmcloud.com/vulnerabilities/13899
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.