Re: rsync security advisory

2003-12-04 Thread Paul Slootman
On Thu 04 Dec 2003, Martin Pool wrote: - rsync version 2.5.6 contains a heap overflow vulnerability that can be used to remotely run arbitrary code. Is this specific to 2.5.6, or are earlier versions also vulnerable? Important detail, as it makes the difference between needing to upgrade

Re: [rsync-announce] rsync security advisory

2003-12-04 Thread Daemian Mack
[EMAIL PROTECTED] wrote: rsync 2.5.6 security advisory - December 4th 2003 Background -- The rsync team has received evidence that a vulnerability in rsync was recently used in combination with a Linux kernel vulnerability to compromise the security of a public

Re: rsync security advisory

2003-12-04 Thread Paul Slootman
On Thu 04 Dec 2003, Paul Haas wrote: On Thu 04 Dec 2003, Martin Pool wrote: - rsync version 2.5.6 contains a heap overflow vulnerability that can be used to remotely run arbitrary code. Is this specific to 2.5.6, or are earlier versions also vulnerable? Important detail, as it

Re: rsync security advisory

2003-12-04 Thread Paul Haas
On Thu, 4 Dec 2003, Paul Slootman wrote: Date: Thu, 4 Dec 2003 11:34:44 +0100 From: Paul Slootman [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: rsync security advisory On Thu 04 Dec 2003, Martin Pool wrote: - rsync version 2.5.6 contains a heap overflow vulnerability that can

[rsync-announce] rsync security advisory

2003-12-03 Thread rsync-announce
rsync 2.5.6 security advisory - December 4th 2003 Background -- The rsync team has received evidence that a vulnerability in rsync was recently used in combination with a Linux kernel vulnerability to compromise the security of a public rsync server. While