lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the adffe51e-9df5-11ef-a660-d85ed309193e advisory.

    cve@mitre.org reports:
    Lrzsz has an integer overflow vulernability in the               src/zm.c:zsdata() function. An attacker could exploit this with               the sz command to cause a crash or potentially leak information               to the receiving server.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2900 advisory.

  - lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length     check in the function zsdata that causes a size_t to wrap around. (CVE-2018-10195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for rzsz fixes the following issues :

  - L3: sz of rzsz segfaults in zsdata() (bsc#1086416)

  - VUL-0: CVE-2018-10195: rzsz: sz can leak data to     receiving side (bsc#1090051)

  - rzsz-0.12.20-976.7: illegal use of freed variable     (bsc#529899)

  - /usr/bin/lsb segfaults [rzsz] (bsc#1076576)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rzsz fixes the following issues :

  - Update to 0.12.21~rc to fix bsc#1086416 and bsc#1090051

  - CVE-2018-10195: segmentation fault in zsdata function     could lead to denial of service (bsc#1090051)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210722	FreeBSD : lrzsz -- Integer overflow in zmodem, crash and information leak (adffe51e-9df5-11ef-a660-d85ed309193e)	Nessus	FreeBSD Local Security Checks	high
157250	Debian DLA-2900-1 : lrzsz - LTS security update	Nessus	Debian Local Security Checks	high
109342	SUSE SLES11 Security Update : rzsz (SUSE-SU-2018:1070-1)	Nessus	SuSE Local Security Checks	high
109341	SUSE SLED12 / SLES12 Security Update : rzsz (SUSE-SU-2018:1066-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-10195

high

Tenable Plugins

high

high

high

high