FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2014-8242

This CVE name corresponds to:

Entered	Topic
2016-01-08	librsync -- collision vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2014-8242 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2014-8242
Phase	Assigned(20141012)

Description

librsync before 1.0.0 uses a truncated MD4 checksum to match blocks, which makes it easier for remote attackers to modify transmitted data via a birthday attack.

References

Source	Reference
MLIST	[oss-security] 20140728 rsync vulnerable to collisions
MLIST	[oss-security] 20140805 [CVE Requests] rsync and librsync collisions
MLIST	[oss-security] 20141012 Re: [CVE Requests] rsync and librsync collisions
MISC	https://www.miknet.net/security/optimizing-birthday-attack/
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=1126712
CONFIRM	https://github.com/librsync/librsync/issues/5
CONFIRM	https://github.com/librsync/librsync/releases/tag/v1.0.0
FEDORA	FEDORA-2015-2923
FEDORA	FEDORA-2015-3366
FEDORA	FEDORA-2015-3497
GENTOO	GLSA-201605-04
SUSE	openSUSE-SU-2015:1752