Published: 10/04/2008 Updated: 13/02/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote malicious users to execute arbitrary code via unknown vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba rsync 2.7.8
samba rsync 2.6.9
samba rsync 2.7.1
samba rsync 2.7.9
samba rsync 3.0.0
samba rsync 2.8.9
samba rsync 2.7.7
samba rsync 2.7.4
samba rsync 2.8.2
samba rsync 2.7.3
samba rsync 2.9.9
samba rsync 2.9.8
samba rsync 2.8.7
samba rsync 2.9.6
samba rsync 2.9.3
samba rsync 2.8.4
samba rsync 2.8.1
samba rsync 2.9.0
samba rsync 2.8.8
samba rsync 2.8.5
samba rsync 2.7.2
samba rsync 2.9.7
samba rsync 2.9.2
samba rsync 2.9.1
samba rsync 2.7.5
samba rsync 2.9.5
samba rsync 2.8.6
samba rsync 2.7.6
samba rsync 2.9.4
samba rsync 2.8.0
samba rsync 2.8.3
samba rsync 3.0.1
samba rsync 2.7.0

Sebastian Krahmer discovered that rsync could overflow when handling ACLs An attacker could construct a malicious set of files that when processed by rsync could lead to arbitrary code execution or a crash ...

Sebastian Krahmer discovered that an integer overflow in rsync's code for handling extended attributes may lead to arbitrary code execution For the stable distribution (etch), this problem has been fixed in version 269-2etch2 For the unstable distribution (sid), this problem has been fixed in version 302-1 We recommend that you upgrade your ...

CWE-119 http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff http://samba.anu.edu.au/rsync/security.html#s3_0_2 http://sourceforge.net/project/shownotes.php?release_id=591462&group_id=69227 http://www.debian.org/security/2008/dsa-1545 http://www.mandriva.com/security/advisories?name=MDVSA-2008:084 http://secunia.com/advisories/29668 http://secunia.com/advisories/29770 http://secunia.com/advisories/29777 http://secunia.com/advisories/29781 http://www.securityfocus.com/bid/28726 http://www.securitytracker.com/id?1019835 https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00237.html https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00247.html http://security.gentoo.org/glsa/glsa-200804-16.xml http://www.osvdb.org/44368 http://www.osvdb.org/44369 http://secunia.com/advisories/29856 http://secunia.com/advisories/29861 http://secunia.com/advisories/29788 http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html http://marc.info/?l=bugtraq&m=125017764422557&w=2 http://www.vupen.com/english/advisories/2008/1215/references http://www.vupen.com/english/advisories/2008/1191/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41766 https://usn.ubuntu.com/600-1/http://www.mail-archive.com/rsync-announce%40lists.samba.org/msg00057.html https://usn.ubuntu.com/600-1/https://nvd.nist.gov

CVE-2008-1720

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect