Unscored severity · published Apr 10, 2008
CVE-2008-1720
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors
–
CVSS
5%
EPSS
No
On KEV
Description
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
Rsync · Samba
2.6.9; 2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +27 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1720
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html
marc.info
http://marc.info/?l=bugtraq&m=125017764422557&w=2
Patch
http://rsync.samba.org/ftp/rsync/security/rsync-3.0.1-xattr-alloc.diff
Patch
http://samba.anu.edu.au/rsync/security.html#s3_0_2
secunia.com
http://secunia.com/advisories/29668
secunia.com
http://secunia.com/advisories/29770
More from Rsync
9.8
CVE-2024-12084
Rsync: heap buffer overflow in rsync due to improper checksum length handling
9.8
CVE-2017-17434
The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in…
9.8
CVE-2017-16548
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a…
9.8
CVE-2017-15994
rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions
9.1
CVE-2026-53791
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header