Mandriva- Advisories MDVSA-2008:011: Updated rsync packages fix restrictions bypass vulnerabilities

[Mandriva]

Advisories MDVSA-2008:011: Updated rsync packages fix restrictions bypass vulnerabilities
rsync before 3.0.0pre6, when running a writable rsync daemon that is
not using chroot, allows remote attackers to access restricted files
via unknown vectors that cause rsync to create a symlink that points
outside of the module's hierarchy. (CVE-2007-6199)

Unspecified vulnerability in rsync before 3.0.0pre6, when running a
writable rsync daemon, allows remote attackers to bypass exclude,
exclude_from, and filter and read or write hidden files via (1)
symlink, (2) partial-dir, (3) backup-dir, and unspecified (4) dest
options. (CVE-2007-6200)

This update fixes these issues. It is recommended users (specially
system and network administrators) read the manpage about the
introduced munge symlinks feature.

This update also upgrades rsync to version 2.6.9 for all Mandriva
Linux versions earlier than 2008.0.
http://mandrivausers.org/index.php?showtopic=47079
http://mandrivausers.org/index.php?showtopic=47079
Sat, 12 Jan 2008 02:15:42 +0000