PT-2002-1078 · Rsync · Rsync

Published 2002-02-11 · Updated 2016-10-18 · CVE-2002-0048

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rsync versions 2.3.2 through 2.4.6

Description The issue is related to multiple signedness errors in the I/O functions of rsync, which can be exploited remotely. These errors, involving mixed signed and unsigned numbers, allow remote attackers to cause a denial of service and potentially execute arbitrary code in the rsync client or server. This could lead to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For rsync version 2.3.2, update to a version that fixes the signedness errors in the I/O functions. For rsync version 2.4.6, update to a version that fixes the signedness errors in the I/O functions. As a temporary workaround, consider restricting access to the rsync client and server to minimize the risk of exploitation.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2015-08212

CVE-2002-0048

Affected Products

Rsync

References · 20

• 🔥 https://exploit-db.com/exploits/21242 · Exploit
• 🔥 https://exploit-db.com/exploits/399 · Exploit
• 🔥 https://exploit-db.com/exploits/398 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0048 · Security Note
• http://redhat.com/support/errata/RHSA-2002-018.html · Vendor Advisory
• http://linuxsecurity.com/advisories/other_advisory-1853.html · Vendor Advisory
• http://caldera.com/support/security/advisories/CSSA-2002-003.0.txt · Vendor Advisory
• http://online.securityfocus.com/advisories/3839 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08212 · Security Note
• http://lists.suse.com/archives/suse-security-announce/2002-Jan/0003.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000458 · Vendor Advisory
• http://securityfocus.com/bid/3958 · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:10.rsync.asc · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-009.php · Vendor Advisory
• http://kb.cert.org/vuls/id/800635 · Note