rsync vulnerability

2007-08-2000:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.9

Confidence

Low

EPSS

0.181

Percentile

96.2%

JSON

Releases

Ubuntu 7.04
Ubuntu 6.10
Ubuntu 6.06

Details

Sebastian Krahmer discovered that rsync contained an off-by-one
miscalculation when handling certain file paths. By creating a specially
crafted tree of files and tricking an rsync server into processing them,
a remote attacker could write a single NULL to stack memory, possibly
leading to arbitrary code execution.

OSVersionArchitecturePackageVersionFilename
Ubuntu7.04noarchrsync< 2.6.9-3ubuntu1.1UNKNOWN
Ubuntu6.10noarchrsync< 2.6.8-2ubuntu3.1UNKNOWN
Ubuntu6.06noarchrsync< 2.6.6-1ubuntu2.1UNKNOWN