Yellow Dog Linux Security Announcement
--------------------------------------

Package:	rsync	
Issue Date: 	January 27, 2002	
Priority:	high		
Advisory ID: 	YDU-20020127-3


1. 	Topic:

	New rsync packages are available; these fix a remotely exploitable problem
	in the I/O functions.

	It is strongly recommended that all users of rsync upgrade to the fixed
	packages.


2. 	Problem:

	rsync is a powerful tool used for mirroring directory structures across
	machines. rsync has been found to contain several signed/unsigned bugs in
	its I/O functions which are remotely exploitable. A remote user can crash
	the rsync server/client and execute code as the user running the rsync
	server or client.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) has
	assigned the name CAN-2002-0048 to this issue.

	All users of rsync should upgrade their packages. In addition rsync server
	administrators should consider using the "use chroot", "uid", and "read
	only" options, which can significantly reduce the impact of a security
	problem in rsync or elsewhere.

	Thanks go to Sebastian Krahmer for providing a patch for this vulnerability
	and to Andrew Tridgell and Martin Pool for their rapid response.
	(from Red Hat advisory)

3. 	Solution:

   	a) Updating via yup...
   	We suggest that you use the Yellow Dog Update Program (yup)
   	to keep your system up-to-date. The following command(s) will
   	automatically retrieve and install the fixed version of
   	this update onto your system:

   		yup update rsync 
 

   	b) Updating manually...
   	The update can also be retrieved manually from our ftp site
   	below along with the rpm command that should be used to install
   	the update.  (Please use a mirror site)

   		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
		rpm -Fvh rsync-2.4.6-8.ppc.rpm


4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
cdb7504ade5757296812a2b0f76d1457  ppc/rsync-2.4.6-8.ppc.rpm
96734cb3b3e235e33f14a19909c97b67  SRPMS/rsync-2.4.6-8.src.rpm

If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see 
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml