Debian Security Advisory
DLA-1725-1 rsync -- LTS security update
- Date Reported:
- 24 Mar 2019
- Affected Packages:
- rsync
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2018-5764.
- More information:
-
Trail of Bits used the automated vulnerability discovery tools developed for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, versatile, remote (and local) file-copying tool, uses an embedded copy of zlib, those issues are also present in rsync.
- CVE-2016-9840
In order to avoid undefined behavior, remove offset pointer optimization, as this is not compliant with the C standard.
- CVE-2016-9841
Only use post-increment to be compliant with the C standard.
- CVE-2016-9842
In order to avoid undefined behavior, do not shift negative values, as this is not compliant with the C standard.
- CVE-2016-9843
In order to avoid undefined behavior, do not pre-decrement a pointer in big-endian CRC calculation, as this is not compliant with the C standard.
- CVE-2018-5764
Prevent remote attackers from being able to bypass the argument-sanitization protection mechanism by ignoring --protect-args when already sent by client.
For Debian 8
Jessie
, these problems have been fixed in version 3.1.1-3+deb8u2.We recommend that you upgrade your rsync packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
- CVE-2016-9840