Executive brief
A design flaw in the Z-Modem file transfer protocol allows a remote sender to execute commands on a recipient's computer. This affects older systems using the rzsz utility, commonly used for transferring files over serial or terminal connections. An attacker could use this to gain full control over the target system during a file transfer session.
Technical details
The vulnerability stems from a design flaw in the Z-Modem protocol implementation within the 'rz' utility of the rzsz package. When a user initiates a file transfer, a malicious remote sender can send specially crafted protocol sequences that trigger the execution of arbitrary shell commands on the receiving client. This is a network-based attack that requires no prior authentication, provided a Z-Modem session is established. The issue was notably addressed in FreeBSD 2.1.5 and later versions.
Affected products
- FreeBSD Project FreeBSD before 2.1.5
- rzsz rzsz module all versions prior to fix
Timeline
- 1996-07-16: disclosed: Initial public disclosure and NVD publication
- 1996-07-16: advisory: FreeBSD security advisory SA-96:17 issued