PT-2021-21062 · Mbsync+2 · Mbsync+2

Lukas Braun · Published 2021-06-07 · Updated 2024-08-08 · CVE-2021-3578

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mbsync versions prior to 1.3.6 mbsync versions prior to 1.4.2

Description: A flaw was found in mbsync where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.

Recommendations: For versions prior to 1.3.6, update to version 1.3.6 or later. For versions prior to 1.4.2, update to version 1.4.2 or later.

Fix

RCE

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

ALT-PU-2024-10502

ALT-PU-2024-10800

CVE-2021-3578

DLA-3066-1

OPENSUSE-SU-2021:1170-1

OPENSUSE-SU-2021:1185-1

OPENSUSE-SU-2021_1170-1

OPENSUSE-SU-2024:10866-1

Affected Products

Alt Linux

Suse

Mbsync

References · 27

• https://openwall.com/lists/oss-security/2021/06/07/1 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2021:1170-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U75UFEWRAZYKVL5NHMPBUOLWN3WXTOEI · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3578 · Security Note
• http://openwall.com/lists/oss-security/2021/06/07/1 · Patch
• https://osv.dev/vulnerability/CVE-2021-3578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3578 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3578 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3578 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3578 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1185-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10866-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1967397 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPIDLIJKNRJHUVBCL7QGAPAAVPIHQGXK · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3578 · Vendor Advisory