1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
6 <!--#include virtual="header.html" -->
8 <H2 align="center">Welcome to the rsync web pages</H2>
10 rsync is an <A HREF="http://www.opensource.org/">open source</A>
11 utility that provides fast incremental file transfer. rsync is freely
12 available under the <A HREF="GPL.html">GNU General Public
15 <p><b style="color:red">**</b>
16 <b>For all versions of rsync prior to 2.6.3pre1, see the
17 <a href="#security_aug04" style="color:red">August 2004 security advisory</a>!</b>
18 <b style="color:red">**</b>
19 <b>If you're using a version prior to 2.6.1, see the
20 <a href="#security_apr04" style="color:red">April 2004 security advisory</a>!</b>
21 <b style="color:red">**</b>
22 <b>If you're using a version prior to 2.5.7, see the
23 <a href="#security_dec03" style="color:red">December 2003 security advisory</a>!</b>
24 <b style="color:red">**</b>
26 <h3>Rsync 2.6.3pre1 released</h3>
28 <p><i style="color:#777777">August 12th, 2004</i>
30 <p>Rsync version 2.6.3pre1 has been released. It contains a few new features and
31 quite a few bug fixes.
32 Please help out with the testing so that we give the latest code a good workout.
34 <p>See the <a href="/ftp/rsync/preview/rsync-2.6.3pre1-NEWS">NEWS file</a> for the
35 details of what changed since 2.6.2.
37 <p>See the <a href="download.html">download page</a> for all the ways
38 to grab the new version (previews are in the "preview" subdir), or snag one of these:
39 <b><a href="/ftp/rsync/preview/rsync-2.6.3pre1.tar.gz">rsync-2.6.3pre1.tar.gz</a>
40 (<a href="/ftp/rsync/preview/rsync-2.6.3pre1.tar.gz.asc">signature</a>),
41 <a href="/ftp/rsync/preview/rsync-2.6.2-2.6.3pre1.diffs.gz">rsync-2.6.1-2.6.3pre1.diffs.gz</a>
42 (<a href="/ftp/rsync/preview/rsync-2.6.2-2.6.3pre1.diffs.gz.asc">signature</a>)</b>.
44 <a name="security_aug04"></a>
45 <h3 style="color:red">August 2004 Security Advisory</h3>
47 <p><i style="color:#777777">August 12th, 2004</i>
51 <p>There is a path-sanitizing bug that affects daemon mode in all recent
52 rsync versions (including 2.6.2) but only if chroot is disabled. It
53 does NOT affect the normal send/receive filenames that specify what
54 files should be transferred (this is because these names happen to get
55 sanitized twice, and thus the second call removes any lingering leading
56 slash(es) that the first call left behind). It does affect certain
57 option paths that cause auxilliary files to be read or written.
61 <p>The best fix is to apply this one-word patch to the sanitize_path()
65 --- orig/util.c 2004-04-27 12:59:37 -0700
66 +++ util.c 2004-08-11 23:37:27 -0700
75 /* back up sanp one level */
78 <p>This bug is fixed in the CVS version of rsync, and will be released in
79 version 2.6.3 (it is currently in release-testing).
81 <p>One potential fix that doesn't require recompiling rsync is to set
82 "use chroot = true" for all the modules in the rsyncd.conf file.
85 <h3>Rsync 2.6.2 released</h3>
87 <p><i style="color:#777777">April 30th, 2004</i>
89 <p>Rsync version 2.6.2 has been released. It is a bugfix release that mainly
90 fixes <b>a bug with the --relative option (-R) in 2.6.1</b>
91 that could cause files to be transferred incorrectly. This only affected a
92 source right at the root of the filesystem, such as "/" or "/*" (using "."
93 as the source after a chdir to "/" was not affected, however).
95 <p>See the <a href="/ftp/rsync/rsync-2.6.2-NEWS">release NEWS</a> for the
96 details of what else was fixed.
98 <p>See the <a href="download.html">download page</a> for all the ways
99 to grab the new version, or snag one of these: <b>
100 <a href="/ftp/rsync/rsync-2.6.2.tar.gz">rsync-2.6.2.tar.gz</a>
101 (<a href="/ftp/rsync/rsync-2.6.2.tar.gz.asc">signature</a>),
102 <a href="/ftp/rsync/rsync-2.6.1-2.6.2.diffs.gz">rsync-2.6.1-2.6.2.diffs.gz</a>
103 (<a href="/ftp/rsync/rsync-2.6.1-2.6.2.diffs.gz.asc">signature</a>)</b>.
105 <h3>Rsync 2.6.1 released</h3>
107 <p><i style="color:#777777">April 26th, 2004</i>
109 <p>Rsync version 2.6.1 has been released. It is primarily a performance
110 release that requires less memory to run, makes fewer write calls to the socket
111 (lowering the system CPU time), does less string copying (lowering the user CPU
112 time), and also reduces the amount of data that is transmitted over the wire.
113 There have also been quite a few bug fixes. See the
114 <a href="/ftp/rsync/old-versions/rsync-2.6.1-NEWS">release NEWS</a> for the full
117 <a name="security_apr04"></a>
118 <h3 style="color:red">April 2004 Security Advisory</h3>
120 <p><i style="color:#777777">April 26th, 2004</i>
122 <p>There is a security problem in all versions prior to 2.6.1 that affects only
123 people running a read/write daemon WITHOUT using chroot. If the user privs
124 that such an rsync daemon is using is anything above "nobody", you are at risk
125 of someone crafting an attack that could write a file outside of the module's
126 "path" setting (where all its files should be stored). Please either enable
127 chroot or upgrade to 2.6.1. People not running a daemon, running a read-only
128 daemon, or running a chrooted daemon are totally unaffected.
130 <p>See the <a href="download.html">download page</a> for all the ways
131 to grab the new version.
133 <h3>One Cygwin hang-problem resolved</h3>
135 <p>The problem with rsync hanging at the end of the transfer on
136 <a href="http://www.cygwin.com/">Cygwin</a> had been previously traced to a
137 signal-handling bug in their compatibility DLL. This bug appears to now be
138 fixed in DLL version 1.5.7-1, and Cygwin users are reporting that upgrading the
139 DLL removes the hang-at-end-of-transfer problem for their existing rsync executable.
140 (Note that this doesn't solve a hang that some folks see in the middle of a
141 transfer -- using daemon mode instead of ssh can work around that one.)
143 <a name="two_six"></a>
144 <h3>Rsync 2.6.0 released</h3>
146 <p><i style="color:#777777">January 1st, 2004</i>
148 <P> Two important things to note in the new release:
152 <li>The default remote shell is now "ssh" unless you tell configure you want to
153 make something else the default.
155 <li>Some bug fixes in the include/exclude code, while making things work
156 properly, have resulted in some user-visible changes for certain wildcard
157 strings. Read the BUG FIXES below to see if any of these changes apply to you.
158 (Most people should be unaffected.)
162 <p>One other item of note is that the oft-requested option "--files-from" is now
163 available. This option lets you specify a list of files to transfer, and can
164 be much more efficient than a recursive descent using include/exclude
165 statements (if you know in advance what files you want to transfer). The list
166 of files can come from either side of the connection, so it is possible for a
167 server to provide the file-list that lets someone grab a server-specified set of
168 files, for example. See the <a href="/ftp/rsync/rsync.html">rsync man page</a>
171 <p>For a full list of changes in version 2.6.0, see the
172 <a href="/ftp/rsync/old-versions/rsync-2.6.0-NEWS">release NEWS</a>.
174 <a name="security_dec03"></a>
175 <h3 style="color:red">December 2003 Security Advisory</h3>
177 <p><i style="color:#777777">December 4th, 2003</i>
181 <p>The rsync team has received evidence that a vulnerability in rsync was
182 recently used in combination with a Linux kernel vulnerability to
183 compromise the security of a public rsync server. While the forensic
184 evidence we have is incomplete, we have pieced together the most
185 likely way that this attack was conducted and we are releasing this
186 advisory as a result of our investigations to date.
189 Our conclusions are that:
193 <li>rsync version 2.5.6 and earlier contains a heap overflow vulnerability that can
194 be used to remotely run arbitrary code.
196 <li>While this heap overflow vulnerability could not be used by itself
197 to obtain root access on a rsync server, it could be used in
198 combination with the recently announced brk vulnerability in the
199 Linux kernel to produce a full remote compromise.
201 <li>The server that was compromised was using a non-default rsyncd.conf
202 option <tt>"use chroot = no"</tt>. The use of this option made the attack on
203 the compromised server considerably easier. A successful attack is
204 almost certainly still possible without this option, but it would
205 be much more difficult.
209 Please note that this vulnerability only affects the use of rsync as a
210 "rsync server". To see if you are running a rsync server you should
211 use the netstat command to see if you are listening on TCP port
212 873. If you are not listening on TCP port 873 then you are not running
215 <h4>New rsync release</h4>
218 In response we have released a new version of rsync, version
219 2.5.7. This is based on the current stable 2.5.6 release with only the
220 changes necessary to prevent this heap overflow vulnerability. There
221 are no new features in this release.
223 We recommend that anyone running a rsync server take the following
227 Update to (at least) rsync version 2.5.7 immediately.
229 If you are running a Linux kernel prior to version 2.4.23 then
230 you should upgrade your kernel immediately. Note that some
231 distribution vendors may have patched versions of the 2.4.x
232 series kernel that fix the brk vulnerability in versions before
233 2.4.23. Check with your vendor security site to ensure that you
234 are not vulnerable to the <tt>brk</tt> problem.
236 Review your <tt>/etc/rsyncd.conf</tt> configuration file. If you are
237 using the option <tt>"use chroot = no"</tt> then remove that line or
238 change it to <tt>"use chroot = yes"</tt>. If you find that you need that
239 option for your rsync service then you should disable your rsync
240 service until you have discussed a workaround with the rsync
241 maintainers on the rsync mailing list. The disabling of the
242 chroot option should not be needed for any normal rsync server.
245 <p>The patches and full source for rsync version 2.5.7 are available from
246 <a href="http://rsync.samba.org/">http://rsync.samba.org/</a> and mirror sites. We expect that vendors will
247 produce updated packages for their distributions shortly.
252 The rsync team would like to thank the following individuals for their
253 assistance in investigating this vulnerability and producing this
257 <li>Timo Sirainen <tss.iki.fi>
258 <li>Mike Warfield <mhw.wittsend.com>
259 <li>Paul Russell <rusty.samba.org>
260 <li>Andrea Barisani <lcars.gentoo.org>
264 The Common Vulnerabilities and Exposures project (cve.mitre.org) has
266 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0962">CAN-2003-0962</a>
274 <!--#include virtual="footer.html" -->