Advisories » MGASA-2021-0525

Updated rsh packages fix security vulnerability

Publication date: 25 Nov 2021
Modification date: 25 Nov 2021
Type: security
Affected Mageia releases : 8
CVE: CVE-2019-7282 , CVE-2019-7283

Description

In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers
to bypass intended access restrictions via the filename of . or an empty
filename. The impact is modifying the permissions of the target directory
on the client side. This is similar to CVE-2018-20685. (CVE-2019-7282)

An issue was discovered in rcp in NetKit through 0.17. For an rcp
operation, the server chooses which files/directories are sent to the
client. However, the rcp client only performs cursory validation of the
object name returned. A malicious rsh server (or Man-in-The-Middle
attacker) can overwrite arbitrary files in a directory on the rcp client
machine. This is similar to CVE-2019-6111. (CVE-2019-7283).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=29675
• https://www.debian.org/lts/security/2021/dla-2822
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7282
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7283

SRPMS

8/core

• rsh-0.17-36.1.mga8