National Cyber Awareness System

Vulnerability Summary for CVE-2003-0962

Overview

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#325603

Name: VU#325603

Hyperlink:http://www.kb.cert.org/vuls/id/325603

External Source: BID

Name: 9153

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/9153

External Source: REDHAT

Name: RHSA-2003:398

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-398.html

External Source: BUGTRAQ

Name: 20031204 rsync security advisory (fwd)

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107055681311602&w=2

External Source: XF

Name: linux-rsync-heap-overflow(13899)

Type: Advisory

Hyperlink:http://xforce.iss.net/xforce/xfdb/13899

External Source: OSVDB

Name: 2898

Hyperlink:http://www.osvdb.org/2898

External Source: SECUNIA

Name: 10474

Hyperlink:http://secunia.com/advisories/10474

External Source: SECUNIA

Name: 10378

Hyperlink:http://secunia.com/advisories/10378

External Source: SECUNIA

Name: 10364

Hyperlink:http://secunia.com/advisories/10364

External Source: SECUNIA

Name: 10363

Hyperlink:http://secunia.com/advisories/10363

External Source: SECUNIA

Name: 10362

Hyperlink:http://secunia.com/advisories/10362

External Source: SECUNIA

Name: 10361

Hyperlink:http://secunia.com/advisories/10361

External Source: SECUNIA

Name: 10360

Hyperlink:http://secunia.com/advisories/10360

External Source: SECUNIA

Name: 10359

Hyperlink:http://secunia.com/advisories/10359

External Source: SECUNIA

Name: 10358

Hyperlink:http://secunia.com/advisories/10358

External Source: SECUNIA

Name: 10357

Hyperlink:http://secunia.com/advisories/10357

External Source: SECUNIA

Name: 10356

Hyperlink:http://secunia.com/advisories/10356

External Source: SECUNIA

Name: 10355

Hyperlink:http://secunia.com/advisories/10355

External Source: SECUNIA

Name: 10354

Hyperlink:http://secunia.com/advisories/10354

External Source: SECUNIA

Name: 10353

Hyperlink:http://secunia.com/advisories/10353

External Source: OVAL

Name: oval:org.mitre.oval:def:9415

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9415

External Source: BUGTRAQ

Name: 20031204 GLSA: exploitable heap overflow in rsync (200312-03)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107056923528423&w=2

External Source: BUGTRAQ

Name: 20031204 [OpenPKG-SA-2003.051] OpenPKG Security Advisory (rsync)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107055702911867&w=2

External Source: TRUSTIX

Name: 2003-0048

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=107055684711629&w=2

External Source: CONECTIVA

Name: CLA-2003:794

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000794

External Source: SGI

Name: 20031202-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20031202-01-U

External Source: MANDRAKE

Name: MDKSA-2003:111

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2003:111

References to Check Content

Identifier:oval:org.mitre.oval:def:9415

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9415