Important information about critical vulnerabilities released today

Good afternoon everyone,

I'm writing this mail to inform you of some critical security 
vulnerabilities that were unveiled to the public today. The 
vulnerabilities have been patched in the development books, and you'll 
need to take immediate action to protect yourself against remote code 
execution, information disclosure, arbitrary file reading/writing, and 
privilege escalation.

This email is about the following packages:

- rsync (CRITICAL)

- vim (Medium)

- Git (Low)

The highlight of this email is rsync. Earlier today, an email from an 
Incident Commander at Red Hat Product Security was sent to oss-security 
regarding rsync. A total of six security vulnerabilities were fixed. 
Please note that it is urgent and imperative that you update rsync on 
your system to 3.4.0 immediately regardless of what you use it for, 
client or server. The vulnerabilities allow for remote code execution on 
servers, information disclosure of stack contents in memory, for servers 
to read files anywhere on a client's filesystem when a client is 
uploading data to a server, for a server to write files to anywhere on a 
client's filesystem, and for privilege escalation when handling symbolic 
links on either a client or a server.

To underscore the severity of this vulnerability, I'd like to quote some 
information from the CERT KB that came out with the announcement of 
these vulnerabilities:

"When combined, the first two vulnerabilities (heap buffer overflow and 
information leak) allow a client to execute arbitrary code on a device 
that has an Rsync server running. The client requires only anonymous 
read-access to the server, such as public mirrors. Additionally, 
attackers can take control of a malicious server and read/write 
arbitrary files of any connected client. Sensitive data, such as SSH 
keys, can be extracted, and malicious code can be executed by 
overwriting files such as ~/.bashrc or ~/.popt."

(See https://kb.cert.org/vuls/id/952657)

Please note that if you have the rsyncd daemon running, an 
unauthenticated user can easily execute arbitrary code on your server. 
This set of security vulnerabilities is some of the worst that I've ever 
seen, and if you have rsync installed on your systems, update 
*immediately*. The BLFS books have been rendered early to make sure that 
this update is available to you at the time of this email being sent.

More information can also be found at the oss-security mailing list 
posting: https://seclists.org/oss-sec/2025/q1/16


The next vulnerability I'd like to talk about is in VIM (which is why I 
also sent this mail to the LFS lists in addition to the BLFS lists). The 
vulnerability is a heap-based buffer overflow that could allow for 
either a crash or arbitrary code execution. It only occurs when using 
visual mode, and happens if you switch buffers using the :all command 
while visual mode is still active. If you use visual mode, you should 
update to vim-9.1.1016.

The final set of vulnerabilities that I'd like to talk about in this 
email is in Git. There are two vulnerabilities fixed, and the first one 
makes users susceptible to leaking credentials to untrusted servers when 
using functions like recursive clones or while updating submodules when 
the submodules require a password. The issue occurs due to Git printing 
unsanitized URLs when asking for credentials, and it would allow for 
these credentials to be sent to an untrusted site instead of the site 
that was intended to receive the credentials. The other vulnerability 
occurs because Git may pass Carriage Returns to credential helpers which 
use line-ending functions that interpret Carriage Returns as line 
endings, even though this isn't what was intended. The issue is known to 
impact Node.js as well as the .NET-based Git Credential Manager. For 
BLFS, that only really applies to Node.js, but if you have Node.js 
installed or use submodules in Git projects you should update to 
git-2.48.1 as soon as you can.

I'd like to bring up again that if you have rsync installed whatsoever, 
you need to update to rsync-3.4.0 immediately.

Thank you,

- Douglas Reno
Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page