Re: [PLUG] rsync flaws

[Steve Litt via plug <plug@lists.phillylinux.org>]

Void Linux also fixed it.

Walt Mankowski via plug said on Wed, 15 Jan 2025 13:57:19 -0500

>Thanks for posting this. There's already a fix out for ubuntu that I'm
>getting ready to install on some servers I maintain.
>
>Walt
>
>On Wed, Jan 15, 2025 at 10:16:50AM -0500, jeffv via plug wrote:
>> Google Cloud Researchers Uncover Flaws in Rsync File Synchronization
>> Tool
>> 
>> https://thehackernews.com/2025/01/google-cloud-researchers-uncover-flaws.html
>> 
>> As many as six security vulnerabilities have been disclosed in the
>> popular Rsync file-synchronizing tool for Unix systems, some of
>> which could be exploited to execute arbitrary code on a client.
>> 
>> "Attackers can take control of a malicious server and read/write
>> arbitrary files of any connected client," the CERT Coordination
>> Center (CERT/CC) said in an advisory. "Sensitive data, such as SSH
>> keys, can be extracted, and malicious code can be executed by
>> overwriting files such as ~/.bashrc or ~/.popt."
>> ___________________________________________________________________________
>> Philadelphia Linux Users Group
>> --        http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
>> General Discussion
>> --   http://lists.phillylinux.org/mailman/listinfo/plug  
>___________________________________________________________________________
>Philadelphia Linux Users Group
>--        http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
>General Discussion
>--   http://lists.phillylinux.org/mailman/listinfo/plug


SteveT

Steve Litt 

http://444domains.com
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug