rsync: exploitable heap overflow

Background rsync is a popular file transfer package used to synchronize the Portage tree. Description Rsync version 2.5.6 contains a vulnerability that can be used to run arbitrary code. The Gentoo infrastructure team has some reasonably good forensic evidence that this exploit may have been used...

DSA-404 rsync - heap overflow

Bulletin has no description...

rsync Service Detection

The remote rsync server can be accessed remotely. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11389; scriptversion "$Revision: 1.24 $"; scriptcvsdate"$Date: 2017/06/12 21:52:41 $"; scriptnameenglish:"rsync Service Detection"; scriptsummaryenglish:"Shows the remote...

rsync I/O Functions Multiple Signedness Errors RCE

The remote rsync server is affected by multiple signedness errors in the I/O functions. An unauthenticated, remote attacker can exploit these to cause a denial of service or execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11390; scriptversion...

rsync fails to properly handle negative values specified for signed integers thereby allowing remote command execution

Overview There exist several signed-integer vulnerabilities in rsync. If rsync is run as a daemon, a remote-root compromise may be possible. Description Included in most distributions of Linux, rsync is a popular tool for synchronizing files across multiple hosts. Though not enabled in the defaul...

CVE-2002-0080

CVE-2002-0080 affects rsync when run in daemon mode: it does not call setgroups before dropping privileges, potentially letting local users inherit supplementary group privileges and read files they shouldn’t. The vulnerability is demonstrated across multiple advisories (Mandrake/MDKSA-2002:024, ...

CVE-2002-0080

rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed...

CVE-2002-0080

rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed...

rsync update fixes security problems

New rsync packages are available to fix security problems. Here's the information from the Slackware 8.0 ChangeLog: ---------------------------- Mon Mar 11 15:09:26 PST 2002 patches/packages/rsync.tgz: Upgraded to rsync-2.5.3. This fixes two security problems: Make sure that supplementary groups...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. Multiple signedness errors mixed signed and unsigned numbers in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsy...

CVE-2002-0048

Multiple signedness errors mixed signed and unsigned numbers in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server...

CVE-2002-0048

Summary: CVE-2002-0048 describes multiple signedness errors in rsync I/O functions that can allow a remote attacker to cause a denial of service or execute arbitrary code in rsync when used as client or daemon/server. Affected versions (from provided documents): rsync 2.4.6, 2.3.2, and other vers...

CVE-2002-0048

Multiple signedness errors mixed signed and unsigned numbers in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server...

FreeBSD-SA-02:10.rsync

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:10 Security Advisory FreeBSD, Inc. Topic: rsync port contains remotely exploitable vulnerability Category: ports Module: rsync Announced: 2002-02-06 Credits: Sebastian...

[SECURITY] [DSA-106-2] updated rsync fix

Package : rsync Problem type : remote exploit Debian-specific: no In Debian Security Advisory DSA-106-1 we reported a exploitable problem in rsync. For details please see that advisory. Unfortunately the patch used to fix that problem broke rsync. This has been fixed in version 2.3.2-1.5 and we...

[SECURITY] [DSA-106-1] rsync remote exploit

Package : rsync Problem type : remote exploit Debian-specific: no Sebastian Krahmer found several places in rsync a popular tool to synchronise files between machines where signed and unsigned numbers were mixed which resulted in insecure code. This could be abused by remote users to write 0-byte...

Отрицательные индексы массива в rsync (negatice array index)

Ошибка отрицательных индексов массива дает возможность удаленного выполнения кода...

SuSE Security Announcement: rsync (SuSE-SA:2002:004)

-----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: rsync Announcement-ID: SuSE-SA:2002:004 Date: Fri Jan 25 17:00:00 CET 2002 Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: remote command executionn Severity 1-10: 7 SuSE default package: no Other affected...

rsync update fixes security problems

New rsync packages are available to fix a security problem. Here's the information from the Slackware 8.0 ChangeLog: Fri Jan 25 14:25:51 PST 2002 patches/packages/rsync.tgz: Fixed a security hole by upgrading to rsync-2.4.8pre1. This is the relevant information from the rsync NEWS file: SECURITY...

rsync 2.3/2.4/2.5 - Signed Array Index Remote Code Execution

// source: https://www.securityfocus.com/bid/3958/info A vulnerability exists within some versions of rsync. Under some circumstances, a remotely supplied signed value is used as an array index, allowing NULL bytes to be written to arbitrary memory locations. Exploitation of this vulnerability...