rsync Signed Array Index Remote Code Execution Vulnerability

BID:3958

Info

rsync Signed Array Index Remote Code Execution Vulnerability

Bugtraq ID: 3958
Class: Access Validation Error
CVE: CVE-2002-0048
Remote: Yes
Local: No
Published: Jan 25 2002 12:00AM
Updated: Jul 11 2009 09:56AM
Credit: The discovery of this vulnerability has been credited to Sebastian Krahmer <[email protected]>.
Vulnerable: rsync rsync 2.5.1
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
- FreeBSD FreeBSD 4.1
rsync rsync 2.4.8
rsync rsync 2.4.6
+ EnGarde Secure Linux 1.0.1
+ HP Secure OS software for Linux 1.0
+ MandrakeSoft Corporate Server 1.0.1
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + SuSE Linux 8.0
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.2 i386
 + SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
rsync rsync 2.4.4
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 rsync rsync 2.4.3
+ Caldera OpenLinux 3.1 -IA64
 + Caldera OpenLinux 2.3
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1
+ Trustix Secure Linux 1.1
rsync rsync 2.4.1
+ Redhat Linux 6.2 sparc
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2 alpha
 + Trustix Secure Linux 1.0 1
 rsync rsync 2.3.2 -1.2 sparc
+ Debian Linux 2.2 sparc
 rsync rsync 2.3.2 -1.2 PPC
+ Debian Linux 2.2 powerpc
 rsync rsync 2.3.2 -1.2 m68k
+ Debian Linux 2.2 68k
 rsync rsync 2.3.2 -1.2 intel
+ Debian Linux 2.2 IA-32
 rsync rsync 2.3.2 -1.2 ARM
+ Debian Linux 2.2 arm
 rsync rsync 2.3.2 -1.2 alpha
+ Debian Linux 2.2 alpha
 rsync rsync 2.3.2
+ SuSE Linux 7.0 sparc
 + SuSE Linux 7.0 ppc
 + SuSE Linux 7.0 i386
 + SuSE Linux 7.0 alpha
 + SuSE Linux 6.4 ppc
 + SuSE Linux 6.4 i386
 + SuSE Linux 6.4 alpha
 rsync rsync 2.3.1
+ Caldera OpenLinux eBuilder 3.0
+ SCO eDesktop 2.4
+ SCO eServer 2.3.1
Not Vulnerable: rsync rsync 2.5.2
+ Immunix Immunix OS 7+
 rsync rsync 2.5 .0
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
- FreeBSD FreeBSD 4.1
rsync rsync 2.4.5
rsync rsync 2.3.2 -1.3

Discussion

rsync Signed Array Index Remote Code Execution Vulnerability

A vulnerability exists within some versions of rsync. Under some circumstances, a remotely supplied signed value is used as an array index, allowing NULL bytes to be written to arbitrary memory locations. Exploitation of this vulnerability could lead to the corruption of the stack, and possibly to execution of arbitrary code as the root user.

It is possible that other versions of rsync share this vulnerability.

Solution / Fix

rsync Signed Array Index Remote Code Execution Vulnerability

Solution:
rsync 2.5.2 is no longer vulnerable to this issue.

There have been some reports that the provided RedHat and Debian updates cause problems. Please refer to Bugzilla bug 58874 in the references section for details and a proposed solution.

HP has published an advisory stating that the fixes for Red Hat Linux should be applied to HP Secure OS software for Linux. The Red Hat fixes are linked to in the solutions section.

RedHat has released an updated advisory and fixes, which are reported to solve the above issues.

Vendor patches:


rsync rsync 2.3.1

rsync rsync 2.3.2 -1.2 ARM

rsync rsync 2.3.2 -1.2 sparc

rsync rsync 2.3.2 -1.2 m68k

rsync rsync 2.3.2 -1.2 intel

rsync rsync 2.3.2 -1.2 alpha

rsync rsync 2.3.2

rsync rsync 2.3.2 -1.2 PPC

rsync rsync 2.4.1

rsync rsync 2.4.3

rsync rsync 2.4.4

rsync rsync 2.4.6

rsync rsync 2.4.8

rsync rsync 2.5.1

References

rsync Signed Array Index Remote Code Execution Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report