Fixed: CVE-2014-2855 - denial of service

Reverted: compilation with system provided zlib

rsync-3.1.1-dos.patch

@@ -0,0 +1,84 @@
+From 0dedfbce2c1b851684ba658861fe9d620636c56a Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayned@samba.org>
+Date: Sun, 13 Apr 2014 13:44:58 -0700
+Subject: [PATCH] Avoid infinite wait reading secrets file.
+
+---
+ authenticate.c |   24 +++++++++++++-----------
+ 1 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/authenticate.c b/authenticate.c
+index 3381b8c..c92746c 100644
+--- rsync/authenticate.c
++++ rsync/authenticate.c
+@@ -102,15 +102,16 @@ static const char *check_secret(int module, const char *user, const char *group,
+ 	char pass2[MAX_DIGEST_LEN*2];
+ 	const char *fname = lp_secrets_file(module);
+ 	STRUCT_STAT st;
+-	int fd, ok = 1;
++	int ok = 1;
+ 	int user_len = strlen(user);
+ 	int group_len = group ? strlen(group) : 0;
+ 	char *err;
++	FILE *fh;
+ 
+-	if (!fname || !*fname || (fd = open(fname, O_RDONLY)) < 0)
++	if (!fname || !*fname || (fh = fopen(fname, "r")) == NULL)
+ 		return "no secrets file";
+ 
+-	if (do_fstat(fd, &st) == -1) {
++	if (do_fstat(fileno(fh), &st) == -1) {
+ 		rsyserr(FLOG, errno, "fstat(%s)", fname);
+ 		ok = 0;
+ 	} else if (lp_strict_modes(module)) {
+@@ -123,29 +124,30 @@ static const char *check_secret(int module, const char *user, const char *group,
+ 		}
+ 	}
+ 	if (!ok) {
+-		close(fd);
++		fclose(fh);
+ 		return "ignoring secrets file";
+ 	}
+ 
+ 	if (*user == '#') {
+ 		/* Reject attempt to match a comment. */
+-		close(fd);
++		fclose(fh);
+ 		return "invalid username";
+ 	}
+ 
+ 	/* Try to find a line that starts with the user (or @group) name and a ':'. */
+ 	err = "secret not found";
+-	while ((user || group) && read_line_old(fd, line, sizeof line, 1)) {
+-		const char **ptr, *s;
++	while ((user || group) && fgets(line, sizeof line, fh) != NULL) {
++		const char **ptr, *s = strtok(line, "\n\r");
+ 		int len;
+-		if (*line == '@') {
++		if (!s)
++			continue;
++		if (*s == '@') {
+ 			ptr = &group;
+ 			len = group_len;
+-			s = line+1;
++			s++;
+ 		} else {
+ 			ptr = &user;
+ 			len = user_len;
+-			s = line;
+ 		}
+ 		if (!*ptr || strncmp(s, *ptr, len) != 0 || s[len] != ':')
+ 			continue;
+@@ -158,7 +160,7 @@ static const char *check_secret(int module, const char *user, const char *group,
+ 		*ptr = NULL; /* Don't look for name again. */
+ 	}
+ 
+-	close(fd);
++	fclose(fh);
+ 
+ 	memset(line, 0, sizeof line);
+ 	memset(pass2, 0, sizeof pass2);
+-- 
+1.7.0.4
+
+ 

rsync.spec

@@ -7,7 +7,7 @@
 Summary: A program for synchronizing files over a network
 Name: rsync
 Version: 3.1.0
-Release: 2%{?prerelease}%{?dist}
+Release: 3%{?prerelease}%{?dist}
 Group: Applications/Internet
 URL: http://rsync.samba.org/
 
@@ -19,14 +19,15 @@ Source4: rsyncd.conf
 Source5: rsyncd.sysconfig
 Source6: rsyncd@.service
 
-BuildRequires: libacl-devel, libattr-devel, autoconf, popt-devel, zlib-devel, systemd-units
+BuildRequires: libacl-devel, libattr-devel, autoconf, popt-devel, systemd-units
-Requires: zlib
+#Requires: zlib
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 License: GPLv3+
 
 Patch0: rsync-man.patch
+Patch1: rsync-3.1.1-dos.patch
 
 %description
 Rsync uses a reliable algorithm to bring remote and host files into
@@ -58,18 +59,13 @@ patch -p1 -i patches/xattrs.diff
 patch -p1 -i patches/copy-devices.diff
 
 %patch0 -p1 -b .man
-
+%patch1 -p1 -b .dos
 
 %build
-rm -fr autom4te.cache
-autoconf -o configure.sh
-autoheader && touch config.h.in
 
-%configure \
+%configure
-  --with-included-zlib=no
     
-make proto
+make %{?_smp_mflags}
-make %{?_smp_mflags} CFLAGS="$RPM_OPT_FLAGS"
 
 %install
 rm -rf $RPM_BUILD_ROOT
@@ -107,6 +103,10 @@ rm -rf $RPM_BUILD_ROOT
 %systemd_postun_with_restart rsyncd.service
 
 %changelog
+* Wed Apr 16 2014 Michal Luscon <mluscon@redhat.com> - 3.1.0-3
+- Fixed: CVE-2014-2855 - denial of service
+- Reverted: compilation with system provided zlib
+
 * Sun Oct 20 2013 Michal Lusocn <mluscon@redhat.com> - 3.1.0-2
 - Update to latest upstream 3.1.0
 - Fixed #1018520 - missing rsyncd@.service