rsync: Arbitrary command execution

Background

File transfer program to keep remote files into sync.

Description

A vulnerability was discovered in rsync’s parse_arguments function in options.c.

Impact

Remote attackers could possibly execute arbitrary commands with the privilege of the process.

Workaround

There is no known workaround at this time.

Resolution

All rsync users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/rsync-3.1.3"