CVE-2018-10195
📋 TL;DR
This vulnerability in lrzsz (a file transfer tool) allows information leakage to the receiving side due to an integer overflow in the zsdata function. Attackers can exploit this to read unintended memory contents from the sending system. Anyone using vulnerable versions of lrzsz for file transfers is affected.
💻 Affected Systems
- lrzsz
📦 What is this software?
Lrzsz by Lrzsz Project
⚠️ Risk & Real-World Impact
Worst Case
Sensitive memory contents (including passwords, keys, or other process data) could be leaked to an attacker-controlled receiving system during file transfers.
Likely Case
Partial memory disclosure of the sending process, potentially revealing sensitive information or system details that could aid further attacks.
If Mitigated
With proper network segmentation and monitoring, impact is limited to potential information disclosure within controlled environments.
🎯 Exploit Status
Exploitation requires the attacker to be the receiving side of an lrzsz file transfer session. No public exploit code has been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.12.21~rc and later
Vendor Advisory: http://www.ohse.de/uwe/software/lrzsz.html
Restart Required: No
Instructions:
1. Update lrzsz package using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install lrzsz. 3. For RHEL/CentOS: sudo yum update lrzsz. 4. For source installations: Download and compile version 0.12.21~rc or later from the official site.
🔧 Temporary Workarounds
Disable lrzsz usage
linuxReplace lrzsz with alternative secure file transfer methods like scp, sftp, or rsync over SSH.
# Remove lrzsz package: sudo apt remove lrzsz
# Or: sudo yum remove lrzsz
Network restrictions
linuxRestrict network access to systems using lrzsz to trusted networks only.
# Example iptables rule: sudo iptables -A INPUT -p tcp --dport 115 -s ! trusted_network -j DROP
🧯 If You Can't Patch
- Replace lrzsz with alternative secure file transfer tools like scp or sftp.
- Isolate systems using lrzsz to segmented network zones with strict access controls.
🔍 How to Verify
Check if Vulnerable:
Check lrzsz version: lrz --version or check package version with your package manager.Check Version:
lrz --version 2>/dev/null || sz --version 2>/dev/null || dpkg -l lrzsz 2>/dev/null || rpm -q lrzsz 2>/dev/nullVerify Fix Applied:
Verify installed version is 0.12.21~rc or later: lrz --version | grep -E '0\.12\.21|0\.12\.22|0\.12\.23'📡 Detection & Monitoring
Log Indicators:
- Unusual file transfer patterns using lrzsz
- Multiple failed or abnormal lrzsz sessions
Network Indicators:
- Port 115 (default lrzsz port) traffic to untrusted destinations
- Unusual data patterns in lrzsz protocol traffic
SIEM Query:
source_port:115 OR dest_port:115 AND (protocol:lrzsz OR process_name:lrz OR process_name:sz)🔗 References
- http://www.ohse.de/uwe/software/lrzsz.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1572058
- https://lists.debian.org/debian-lts-announce/2022/01/msg00027.html
- https://lists.suse.com/pipermail/sle-security-updates/2018-April/003955.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931
- https://lists.suse.com/pipermail/sle-security-updates/2018-April/003956.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931
- http://www.ohse.de/uwe/software/lrzsz.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1572058
- https://lists.debian.org/debian-lts-announce/2022/01/msg00027.html
- https://lists.suse.com/pipermail/sle-security-updates/2018-April/003955.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931
- https://lists.suse.com/pipermail/sle-security-updates/2018-April/003956.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931
