[arch-security] [ASA-201503-10] librsync: checksum collision
anthraxx at archlinux.org
Mon Mar 16 01:19:40 UTC 2015
Arch Linux Security Advisory ASA-201503-10
Date : 2015-03-16
CVE-ID : CVE-2014-8242
Package : librsync
Type : checksum collision
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package librsync before version 1.0.0-1 is vulnerable to checksum
collision leading to possible file modification or corruption via a
Upgrade to 1.0.0-1.
# pacman -Syu "librsync>=1.0.0-1"
The problem has been fixed upstream in version 1.0.0.
librsync previously used a truncated MD4 "strong" check sum to match
blocks. However, MD4 is not cryptographically strong. It's possible that
an attacker who can control the contents of one part of a file could use
it to control other regions of the file, if it's transferred using
librsync/rdiff. For example this might occur in a database, mailbox, or
VM image containing some attacker-controlled data.
To mitigate this issue, signatures will by default be computed with a
256-bit BLAKE2 hash. Old versions of librsync will complain about a bad
magic number when given these signature files.
An attacker is able to take advantage of the weak checksum calculation
by using a birthday attack in order to corrupt or modify files that are
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security