CVE-2007-4091
Summary
| CVE | CVE-2007-4091 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-08-16 00:17:00 UTC |
| Updated | 2018-10-15 21:33:00 UTC |
| Description | Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| rPath update for rsync - Secunia Advisories - Vulnerability Intelligence - Secunia.com | SECUNIA | secunia.com | |
| Gentoo update for rsync - Advisories - Secunia | SECUNIA | secunia.com | |
| About Secunia Research | Flexera | SECUNIA | secunia.com | |
| 2007-0026 | TRUSTIX | www.trustix.org | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Debian update for rsync - Advisories - Secunia | SECUNIA | secunia.com | |
| SUSE Update for Multiple Packages - Advisories - Secunia | SECUNIA | secunia.com | |
| Webmail - OVH | VUPEN | www.vupen.com | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| The Slackware Linux Project: Slackware Security Advisories | SLACKWARE | slackware.com | |
| About Secunia Research | Flexera | SECUNIA | secunia.com | |
| USN-500-1: rsync vulnerability | Ubuntu | UBUNTU | www.ubuntu.com | |
| support.f5.com/kb/en-us/solutions/public/15000/500/sol15548.html | CONFIRM | support.f5.com | |
| rsync "f_name()" Off-By-One Vulnerability - Advisories - Secunia | SECUNIA | secunia.com | |
| Debian -- Security Information -- DSA-1360-1 rsync | DEBIAN | www.debian.org | |
| C skills: CVE-2007-4091 | CONFIRM | c-skills.blogspot.com | |
| Security Advisory SA61039 - F5 Multiple Products Rsync "f_name()" Arbitrary Code Execution Vulnerability - Secunia | SECUNIA | secunia.com | |
| Trustix Update for Multiple Packages - Advisories - Secunia | SECUNIA | secunia.com | |
| Gmane -- Mail To News And Back Again | CONFIRM | article.gmane.org | |
| issues.rpath.com/browse/RPL-1647 | CONFIRM | issues.rpath.com | |
| Slackware update for rsync - Advisories - Secunia | SECUNIA | secunia.com | |
| Security Announcement | SUSE | www.novell.com | |
| Rsync F_Name Off-By-One Buffer Overflow Vulnerability | BID | www.securityfocus.com | |
| Gentoo Linux Documentation -- rsync: Two buffer overflows | GENTOO | security.gentoo.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-08-22 | Mark J Cox | Not vulnerable. This flaw did not affect Red Hat Enterprise Linux 2.1, 3, or 4 due to the version of rsync. This flaw does exist in Red Hat Enterprise Linux 5, but due to the nature of the flaw it is not exploitable with any security consequence due to stack-protector. |
There are currently no legacy QID mappings associated with this CVE.