high7.5
CVE-2008-1720
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown ve…
Impact
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Samba | Rsync | Versions 2.6.9, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html
- http://marc.info/?l=bugtraq&m=125017764422557&w=2
- http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff
- http://samba.anu.edu.au/rsync/security.html#s3_0_2
- http://secunia.com/advisories/29668
- http://secunia.com/advisories/29770
- http://secunia.com/advisories/29777
- http://secunia.com/advisories/29781
- http://secunia.com/advisories/29788
- http://secunia.com/advisories/29856
- http://secunia.com/advisories/29861
- http://security.gentoo.org/glsa/glsa-200804-16.xml
- http://sourceforge.net/project/shownotes.php?release_id=591462&group_id=69227
- http://www.debian.org/security/2008/dsa-1545
- http://www.mail-archive.com/rsync-announce%40lists.samba.org/msg00057.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:084
- http://www.osvdb.org/44368
- http://www.osvdb.org/44369
- http://www.securityfocus.com/bid/28726
- http://www.securitytracker.com/id?1019835
- http://www.vupen.com/english/advisories/2008/1191/references
- http://www.vupen.com/english/advisories/2008/1215/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41766
- https://usn.ubuntu.com/600-1/
- https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00237.html