PT-2011-1146 · Rsync+1 · Rsync+1

Matt Mccutchen + 1 · Published 2011-03-28 · Updated 2024-06-15 · CVE-2011-1097

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rsync versions 3.0.6 through 3.0.7 rsync version 3.x before 3.0.8

Description The issue allows remote rsync servers to cause a denial of service or possibly execute arbitrary code via malformed data when certain recursion, deletion, and ownership options are used. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

Recommendations For rsync versions 3.0.6 through 3.0.7, update to version 3.0.8 or later. For rsync version 3.x before 3.0.8, update to version 3.0.8 or later. As a temporary workaround, consider restricting access to the rsync server to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-07512

BDU:2015-07513

CVE-2011-1097

OPENSUSE-SU-2024:10548-1

RHSA-2011:0390

RHSA-2011_0390

Affected Products

Red Hat

Rsync

References · 34

• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057641.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057737.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07512 · Security Note
• http://vupen.com/english/advisories/2011/0792 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133226187115472&w=2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1097 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1097 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0390.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:066 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0793 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=675036 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1097 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-1097 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10548-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057736.html · Vendor Advisory