Debian Security Advisory

DLA-1725-1 rsync -- LTS security update

Date Reported:
24 Mar 2019
Affected Packages:
rsync
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843, CVE-2018-5764.
More information:

Trail of Bits used the automated vulnerability discovery tools developed for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, versatile, remote (and local) file-copying tool, uses an embedded copy of zlib, those issues are also present in rsync.

  • CVE-2016-9840

    In order to avoid undefined behavior, remove offset pointer optimization, as this is not compliant with the C standard.

  • CVE-2016-9841

    Only use post-increment to be compliant with the C standard.

  • CVE-2016-9842

    In order to avoid undefined behavior, do not shift negative values, as this is not compliant with the C standard.

  • CVE-2016-9843

    In order to avoid undefined behavior, do not pre-decrement a pointer in big-endian CRC calculation, as this is not compliant with the C standard.

  • CVE-2018-5764

    Prevent remote attackers from being able to bypass the argument-sanitization protection mechanism by ignoring --protect-args when already sent by client.

For Debian 8 Jessie, these problems have been fixed in version 3.1.1-3+deb8u2.

We recommend that you upgrade your rsync packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS