=====================================================================
                                  CERT-Renater

                       Note d'Information No. 2005/VULN262
_____________________________________________________________________

DATE                      : 14/04/2005

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running rsnapshot versions prior to 1.2.1.

======================================================================

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200504-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                             http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

   Severity: High
      Title: rsnapshot: Local privilege escalation
       Date: April 13, 2005
       Bugs: #88681
         ID: 200504-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

rsnapshot allow a local user to take ownership of local files,
resulting in privilege escalation.

Background
==========

rsnapshot is a filesystem snapshot utility based on rsync, allowing
local and remote systems backups.

Affected packages
=================

     -------------------------------------------------------------------
      Package             /  Vulnerable  /                   Unaffected
     -------------------------------------------------------------------
   1  net-misc/rsnapshot       < 1.2.1                         >= 1.2.1

Description
===========

The copy_symlink() subroutine in rsnapshot follows symlinks when
changing file ownership, instead of changing the ownership of the
symlink itself.

Impact
======

Under certain circumstances, local attackers can exploit this
vulnerability to take ownership of arbitrary files, resulting in local
privilege escalation.

Workaround
==========

The copy_symlink() subroutine is not called if the cmd_cp parameter has
been enabled.

Resolution
==========

All rsnapshot users should upgrade to the latest version:

     # emerge --sync
     # emerge --ask --oneshot --verbose ">=net-misc/rsnapshot-1.2.1"

References
==========

   [ 1 ] rsnapshot Security Advisory 001
         http://www.rsnapshot.org/security/2005/001.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

   http://security.gentoo.org/glsa/glsa-200504-12.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0



======================================================================

         =========================================================
         Les serveurs de référence du CERT-Renater
         http://www.urec.fr/securite
         http://www.cru.fr/securite
         http://www.renater.fr
         =========================================================
         + CERT-RENATER          | tel : 01-53-94-20-44          +
         + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
         + 75013 Paris           | email: certsvp@renater.fr     +
         =========================================================