CVE-2014-2855

What it actually does

The check_secret function enters an infinite loop when presented with a username absent from the secrets file, resulting in sustained CPU consumption and denial of service.

Why it matters to the business

Systems running the affected rsync service can become unresponsive under minimal attacker effort, disrupting file synchronization operations and requiring manual intervention to restore availability.

How an attack unfolds

An attacker connects to an rsync daemon and supplies an authentication request containing a username that does not exist in the configured secrets file, causing the check_secret routine to loop indefinitely and exhaust CPU resources.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 11.2.202.554ubuntu0.14.04.1 or later; for rsync deployments apply the corresponding vendor patch that resolves the check_secret logic error.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release, then test authentication with a non-existent username to verify the loop condition no longer occurs.

Typical attack path

1. Establish a network connection to the rsync service port
2. Issue an authentication request containing a non-existent username
3. Trigger the infinite loop inside check_secret
4. Observe sustained high CPU usage and service unavailability

How to detect it

Review rsync daemon logs for repeated authentication attempts using usernames absent from the secrets file; correlate with sustained high CPU usage on the rsync process.

What your security team should do

• Apply the listed fixed package versions immediately on all exposed Ubuntu 14.04 systems
• Disable rsync daemon exposure to untrusted networks until patched
• Monitor EPSS trend for any increase indicating rising exploit interest