Bug 900914 (CVE-2014-8242) - VUL-1: CVE-2014-8242: librsync, rsync: checksum collisions leading to a denial of service
Summary: VUL-1: CVE-2014-8242: librsync, rsync: checksum collisions leading to a denia...
Status: RESOLVED FIXED
Alias: CVE-2014-8242
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Deadline: 2016-01-22
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/109123/
Whiteboard: CVSSv2:RedHat:CVE-2014-8242:4.0:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-13 12:07 UTC by Sebastian Krahmer
Modified: 2019-04-26 09:31 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
rsync patch for SLE-11 (3.07 KB, patch)
2015-11-11 13:47 UTC, Vítězslav Čížek
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2014-10-13 12:07:21 UTC
rh#1126712



References:
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
Comment 2 Vítězslav Čížek 2014-10-13 12:27:55 UTC
From http://www.openwall.com/lists/oss-security/2014/10/13/2:

> Use CVE-2014-8242 for this vulnerability in librsync; this CVE ID does
> not apply to rsync.

This CVE is for librsync, rsync hasn't got one yet.
Comment 3 Swamp Workflow Management 2014-10-13 22:00:32 UTC
bugbot adjusting priority
Comment 4 Vítězslav Čížek 2014-10-29 13:42:32 UTC
From http://www.openwall.com/lists/oss-security/2014/09/18/1
it seems that it can take quite some time until it's fixed in rsync upstream.

The PoC patch isn't publicly available.
Comment 5 Victor Pereira 2015-02-16 09:51:21 UTC
POC: https://github.com/therealmik/rsync-collision
Comment 6 Victor Pereira 2015-02-16 09:53:16 UTC
POC for librsync: https://github.com/therealmik/librsync-collision
Comment 7 Victor Pereira 2015-02-16 09:59:16 UTC
patch and discussion https://github.com/librsync/librsync/issues/5. We should download the last version and diff it. the first commit was https://github.com/librsync/librsync/commit/152323729ac831727032daf50a10c1448b48f252, but after that new code was added on top of that.
Comment 9 Bernhard Wiedemann 2015-02-16 16:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (900914) was mentioned in
https://build.opensuse.org/request/show/286356 Factory / librsync
https://build.opensuse.org/request/show/286357 13.2 / librsync
https://build.opensuse.org/request/show/286358 13.1 / librsync
Comment 10 Victor Pereira 2015-03-18 15:22:41 UTC
just factory and opensuse are affected?
Comment 11 Tomáš Chvátal 2015-03-23 09:42:08 UTC
(In reply to Victor Pereira from comment #10)
> just factory and opensuse are affected?

Nope, the openSUSE was rejected, the upstream changed api+abi and I would actually have to fix all the depending packages too. So this will be FUN when you guys decide you really want the fix.

Also everything is technically affected.
Comment 12 Vítězslav Čížek 2015-04-16 12:23:31 UTC
I asked on oss-sec about rsync:
http://www.openwall.com/lists/oss-security/2015/04/11/3

There seems to be no progress at all since the initial report.
Comment 13 Vítězslav Čížek 2015-08-03 15:53:20 UTC
Finally there's a fix (and a possible workaround) for rsync:
https://bugzilla.redhat.com/show_bug.cgi?id=1197601#c4
Comment 14 Vítězslav Čížek 2015-10-06 14:02:01 UTC
rsync upstream added a compatibility flag that will make rsync process the checksum seed prior to the data to avoid the collisions.
This change is backwards compatible, the flag will be set only if both the client and the server support it.
Comment 15 Bernhard Wiedemann 2015-10-07 14:00:17 UTC
This is an autogenerated message for OBS integration:
This bug (900914) was mentioned in
https://build.opensuse.org/request/show/337006 13.2+13.1+Leap:42.1 / rsync+rsync.openSUSE_Leap_42.1
Comment 16 Bernhard Wiedemann 2015-10-14 14:00:26 UTC
This is an autogenerated message for OBS integration:
This bug (900914) was mentioned in
https://build.opensuse.org/request/show/338846 Leap:42.1 / rsync
Comment 17 Swamp Workflow Management 2015-10-15 09:10:08 UTC
openSUSE-SU-2015:1752-1: An update that solves one vulnerability and has two fixes is now available.

Category: security (moderate)
Bug References: 898513,900914,922710
CVE References: CVE-2014-8242
Sources used:
openSUSE 13.2 (src):    rsync-3.1.1-2.7.1
openSUSE 13.1 (src):    rsync-3.1.0-21.15.1
Comment 19 Vítězslav Čížek 2015-11-11 13:47:45 UTC
Created attachment 655537 [details]
rsync patch for SLE-11

Backported commit eac858085e3ac94ec0ab5061d11f52652c90a869.
Comment 21 SMASH SMASH 2016-01-04 12:23:38 UTC
An update workflow for this issue was started.

This issue was rated as "low".
Please submit fixed packages until "Jan. 18, 2016".

When done, reassign the bug to "security-team@suse.de".
/update/121217/.
Comment 22 Swamp Workflow Management 2016-01-04 12:29:39 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-01-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62401
Comment 26 SMASH SMASH 2016-01-08 10:09:13 UTC
An update workflow for this issue was started.

This issue was rated as "low".
Please submit fixed packages until "Jan. 15, 2016".

When done, reassign the bug to "security-team@suse.de".
/update/62416/.
Comment 27 Swamp Workflow Management 2016-01-08 10:09:30 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-01-22.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62416
Comment 31 Swamp Workflow Management 2016-01-19 23:11:32 UTC
SUSE-SU-2016:0173-1: An update that solves two vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 898513,900914,915410,922710
CVE References: CVE-2014-8242,CVE-2014-9512
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    rsync-3.1.0-6.1
SUSE Linux Enterprise Server 12 (src):    rsync-3.1.0-6.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    rsync-3.1.0-6.1
SUSE Linux Enterprise Desktop 12 (src):    rsync-3.1.0-6.1
Comment 33 Swamp Workflow Management 2016-01-20 12:12:10 UTC
SUSE-SU-2016:0176-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 900914,915410
CVE References: CVE-2014-8242,CVE-2014-9512
Sources used:
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    rsync-3.0.4-2.49.1
SUSE Linux Enterprise Server 11-SP4 (src):    rsync-3.0.4-2.49.1
SUSE Linux Enterprise Server 11-SP3 (src):    rsync-3.0.4-2.49.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    rsync-3.0.4-2.49.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    rsync-3.0.4-2.49.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    rsync-3.0.4-2.49.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    rsync-3.0.4-2.49.1
Comment 34 Swamp Workflow Management 2019-04-26 09:31:43 UTC
This is an autogenerated message for OBS integration:
This bug (900914) was mentioned in
https://build.opensuse.org/request/show/698102 15.1 / rsync