Technical Description

Two vulnerabilities have been identified in Mandriva, which could be exploited by attackers to bypass security restrictions [...]

Solution

Upgrade the affected packages :

Mandriva Linux 2007.0:
fdea773146cff55a58e6c021a411d0d9 2007.0/i586/rsync-2.6.9-0.1mdv2007.0.i586.rpm
93afe1627418872e14aacf9ee2ed4d18 2007.0/SRPMS/rsync-2.6.9-0.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
d9f0b368c1432feba67f51f5d4053d06 2007.0/x86_64/rsync-2.6.9-0.1mdv2007.0.x86_64.rpm
93afe1627418872e14aacf9ee2ed4d18 2007.0/SRPMS/rsync-2.6.9-0.1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
62323582b53e066d60edd4a38c0edcee 2007.1/i586/rsync-2.6.9-1.2mdv2007.1.i586.rpm
b4e0a376cd14cc27d6006f3844e1b576 2007.1/SRPMS/rsync-2.6.9-1.2mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
3f710d1bfb189380264dd57a701b069a 2007.1/x86_64/rsync-2.6.9-1.2mdv2007.1.x86_64.rpm
b4e0a376cd14cc27d6006f3844e1b576 2007.1/SRPMS/rsync-2.6.9-1.2mdv2007.1.src.rpm

Mandriva Linux 2008.0:
55755e81158e1664c48ae5fa69130ca1 2008.0/i586/rsync-2.6.9-5.1mdv2008.0.i586.rpm
e161a0b5150e3d74f8671dbf0aa9e2aa 2008.0/SRPMS/rsync-2.6.9-5.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
df57566d88efb9493b6f417c562d5e3f 2008.0/x86_64/rsync-2.6.9-5.1mdv2008.0.x86_64.rpm
e161a0b5150e3d74f8671dbf0aa9e2aa 2008.0/SRPMS/rsync-2.6.9-5.1mdv2008.0.src.rpm

Corporate 3.0:
7949dd695db813c06f9fc7db853864f8 corporate/3.0/i586/rsync-2.6.9-0.1.C30mdk.i586.rpm
21df68a34ef7732f1a0685d850ceb46d corporate/3.0/SRPMS/rsync-2.6.9-0.1.C30mdk.src.rpm

Corporate 3.0/X86_64:
5a4327131d15f9b008b32471eac47877 corporate/3.0/x86_64/rsync-2.6.9-0.1.C30mdk.x86_64.rpm
21df68a34ef7732f1a0685d850ceb46d corporate/3.0/SRPMS/rsync-2.6.9-0.1.C30mdk.src.rpm

Corporate 4.0:
36f429d7b5f59514b357739cfa022058 corporate/4.0/i586/rsync-2.6.9-0.1.20060mlcs4.i586.rpm
522dab65e48a0d2ce46d7bd29374c5ce corporate/4.0/SRPMS/rsync-2.6.9-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
2c57404df93fae7ac16e27f15bf1cc16 corporate/4.0/x86_64/rsync-2.6.9-0.1.20060mlcs4.x86_64.rpm
522dab65e48a0d2ce46d7bd29374c5ce corporate/4.0/SRPMS/rsync-2.6.9-0.1.20060mlcs4.src.rpm

ChangeLog

2008-01-14 : Initial release

Vulnerability Management

Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.