Description
Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- rsync 2.3/2.4/2.5 - Signed Array Index Remote Code Execution EDB-21242 · remote · Jan 25, 2002 · verified
- rsync 2.5.1 - Remote (1) EDB-398 · remote · Jan 1, 2002 · verified
- rsync 2.5.1 - Remote (2) EDB-399 · remote · Jan 1, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 3958 vdb-entry
- 20020128 TSLSA-2002-0025 - rsync mailing-list
- ESA-20020125-004 vendor-advisory
- 20020127 rsync-2.5.2 has security fix (was: Re: [RHSA-2002:018-05] New rsync packages available) mailing-list
- CLA-2002:458 vendor-advisory
- VU#800635 third-party-advisory
- DSA-106 vendor-advisory
- SuSE-SA:2002:004 vendor-advisory
- CSSA-2002-003.0 vendor-advisory
- linux-rsync-root-access(7993) vdb-entry
- RHSA-2002:018 vendor-advisory
- HPSBTL0201-022 vendor-advisory
- MDKSA-2002:009 vendor-advisory