[ MDKSA-2007:166 ] - Updated rsync packages fix off-by-one buffer overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 Mandriva Linux Security Advisory                         MDKSA-2007:166

 Package : rsync
 Date    : August 18, 2007
 Affected: 2007.0, 2007.1, Corporate 4.0

 _______________________________________________________________________

 

 Problem Description:  

 Sebastian Krahmer of the SUSE Security Team discovered an off-by-one  buffer overflow within rsync. It is not clear if this problem is  exploitable, however updates are available to correct the issue.

 References:  

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4091

 Updated Packages:  

 Mandriva Linux 2007.0:
 7b0c5424444c99181f9283f8d584820b 2007.0/i586/rsync-2.6.8-3.1mdv2007.0.i586.rpm  8422a0235e1bd6a69a5d452f461df534 2007.0/SRPMS/rsync-2.6.8-3.1mdv2007.0.src.rpm

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

 Mandriva Linux 2007.0/X86_64:
 52676839c4467ca1cd80cd7976757cea 2007.0/x86_64/rsync-2.6.8-3.1mdv2007.0.x86_64.rpm  8422a0235e1bd6a69a5d452f461df534 2007.0/SRPMS/rsync-2.6.8-3.1mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 915d44a76b37ec5e17b0899849e527db 2007.1/i586/rsync-2.6.9-1.1mdv2007.1.i586.rpm  38b3ca6d286049cb04c54f7f10e5186e 2007.1/SRPMS/rsync-2.6.9-1.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 0681877f97a2d02d8bc95295626560d9 2007.1/x86_64/rsync-2.6.9-1.1mdv2007.1.x86_64.rpm  38b3ca6d286049cb04c54f7f10e5186e 2007.1/SRPMS/rsync-2.6.9-1.1mdv2007.1.src.rpm

 Corporate 4.0:
 d0aa26829de006aab9cc0ce237f81a96 corporate/4.0/i586/rsync-2.6.6-1.1.20060mlcs4.i586.rpm  417cd6ce0a47db43d97dfea6b098a580 corporate/4.0/SRPMS/rsync-2.6.6-1.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 98f1f8032c050a9687e691a017162e54 corporate/4.0/x86_64/rsync-2.6.6-1.1.20060mlcs4.x86_64.rpm  417cd6ce0a47db43d97dfea6b098a580 corporate/4.0/SRPMS/rsync-2.6.6-1.1.20060mlcs4.src.rpm

 To upgrade automatically use MandrivaUpdate or urpmi. The verification  of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security. You can obtain the  GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com

 Type Bits/KeyID Date User ID
 pub 1024D/22458A98 2000-07-10 Mandriva Security Team   <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGx2SqmqjQ0CJFipgRAjY+AJwIauX4dyBl6FWDsPJT259LrGgqHQCgom+8 M6tbHPJ1dRyJeipy7mmTwAg=
=WsvZ
-----END PGP SIGNATURE----- Received on Mon Aug 20 13:02:07 2007