Slackware: 'rsync' Multiple vulnerabilities
March 12, 2002
Fixes the zlib vulnerability and supplementary groups are removed from a server process after changing uid and gid.
Summary
Where Find New Packages
MD5 Signatures
Severity
Date: Mon, 11 Mar 2002 15:25:45 -0800 (PST) From: Slackware Security Team <security@slackware.com> To: slackware-security@slackware.com Subject: [slackware-security] rsync update fixes security problems
New rsync packages are available to fix security problems.
Here's the information from the Slackware 8.0 ChangeLog:
---------------------------- Mon Mar 11 15:09:26 PST 2002 patches/packages/rsync.tgz: Upgraded to rsync-2.5.3. This fixes two security problems:
* Make sure that supplementary groups are removed from a server process after changing uid and gid. (Ethan Benson) (Debian bug #132272, CVE CAN-2002-0080)
* Fix zlib double-free bug. (Owen Taylor, Mark J Cox) (CVE CAN-2002-0059)
(* Security fix *) ----------------------------
We recommend that sites providing external rsync access upgrade to the fixed rsync package as soon as possible.
WHERE TO FIND THE NEW PACKAGE: ------------------------------ Updated rsync package for Slackware 8.0:
Updated rsync package for Slackware 7.1:
MD5 SIGNATURE: --------------
Here are the md5sums for the packages:
Slackware 8.0: e88390bae124be2af4b707ad3fbfc791 rsync.tgz
Slackware 7.1: 959b82dd4fbb84da564b2ce18eb56afc rsync.tgz
INSTALLATION INSTRUCTIONS: --------------------------
Simply upgrade as root:
# upgradepkg rsync.tgz
Remember, it's also a good idea to backup configuration files before upgrading packages.
- Slackware Linux Security Team The Slackware Linux Project
Installation Instructions
