[Secure-testing-team] Bug#880954: rsync: CVE-2017-16548: receive_xattr heap overread with non null terminated name

[Salvatore Bonaccorso]

Source: rsync
Version: 3.1.2-1
Severity: important
Tags: patch security upstream
Forwarded: https://bugzilla.samba.org/show_bug.cgi?id=13112

Hi,

the following vulnerability was published for rsync.

CVE-2017-16548[0]:
| The receive_xattr function in xattrs.c in rsync 3.1.2 and
| 3.1.3-development does not check for a trailing '\0' character in an
| xattr name, which allows remote attackers to cause a denial of service
| (heap-based buffer over-read and application crash) or possibly have
| unspecified other impact by sending crafted data to the daemon.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16548
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548
[1] https://bugzilla.samba.org/show_bug.cgi?id=13112
[2] https://git.samba.org/rsync.git/?p=rsync.git;a=commit;h=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore