National Cyber-Alert System

Vulnerability Summary for CVE-2008-1720

Overview

Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (04/15/2008)

Not vulnerable. This issue did not affect versions of rsync as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://samba.anu.edu.au/rsync/security.html#s3_0_2

Type: Patch Information

Hyperlink:http://samba.anu.edu.au/rsync/security.html#s3_0_2

External Source: CONFIRM

Name: http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff

Type: Patch Information

Hyperlink:http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff

External Source: HP

Name: SSRT090062

Hyperlink:http://marc.info/?l=bugtraq&m=125017764422557&w=2

External Source: HP

Name: SSRT090062

Hyperlink:http://marc.info/?l=bugtraq&m=125017764422557&w=2

External Source: FEDORA

Name: FEDORA-2008-3060

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00247.html

External Source: FEDORA

Name: FEDORA-2008-3047

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00237.html

External Source: XF

Name: rsync-xattr-bo(41766)

Hyperlink:http://xforce.iss.net/xforce/xfdb/41766

External Source: UBUNTU

Name: USN-600-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-600-1

External Source: SECTRACK

Name: 1019835

Hyperlink:http://www.securitytracker.com/id?1019835

External Source: BID

Name: 28726

Hyperlink:http://www.securityfocus.com/bid/28726

External Source: OSVDB

Name: 44369

Hyperlink:http://www.osvdb.org/44369

External Source: OSVDB

Name: 44368

Hyperlink:http://www.osvdb.org/44368

External Source: MANDRIVA

Name: MDVSA-2008:084

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:084

External Source: MLIST

Name: [rsync-announce] 20080408 Rsync 3.0.2 released w/xattr security fix (attn: 2.6.9 onward)

Hyperlink:http://www.mail-archive.com/rsync-announce@lists.samba.org/msg00057.html

External Source: VUPEN

Name: ADV-2008-1215

Hyperlink:http://www.frsirt.com/english/advisories/2008/1215/references

External Source: VUPEN

Name: ADV-2008-1191

Hyperlink:http://www.frsirt.com/english/advisories/2008/1191/references

External Source: DEBIAN

Name: DSA-1545

Hyperlink:http://www.debian.org/security/2008/dsa-1545

External Source: CONFIRM

Name: http://sourceforge.net/project/shownotes.php?release_id=591462&group_id=69227

Hyperlink:http://sourceforge.net/project/shownotes.php?release_id=591462&group_id=69227

External Source: GENTOO

Name: GLSA-200804-16

Hyperlink:http://security.gentoo.org/glsa/glsa-200804-16.xml

External Source: SECUNIA

Name: 29861

Hyperlink:http://secunia.com/advisories/29861

External Source: SECUNIA

Name: 29856

Hyperlink:http://secunia.com/advisories/29856

External Source: SECUNIA

Name: 29788

Hyperlink:http://secunia.com/advisories/29788

External Source: SECUNIA

Name: 29781

Hyperlink:http://secunia.com/advisories/29781

External Source: SECUNIA

Name: 29777

Hyperlink:http://secunia.com/advisories/29777

External Source: SECUNIA

Name: 29770

Hyperlink:http://secunia.com/advisories/29770

External Source: SECUNIA

Name: 29668

Hyperlink:http://secunia.com/advisories/29668

External Source: SUSE

Name: SUSE-SR:2008:011

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html