Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers to cause a denial of service and execute arbitrary code in the rsync client or server.

Sebastian Krahmer found several places in rsync (a popular tool to  synchronise files between machines) where signed and unsigned numbers  were mixed which resulted in insecure code (see securityfocus.com).
 This could be abused by remote users to write 0-bytes in rsync's  memory and trick rsync into executing arbitrary code.

The remote rsync server might be vulnerable to an array index overflow. An attacker may use this flaw to gain a shell on this host.

Sebastian Krahmer of the SuSE Security Team performed an audit on the rsync tool and discovered that in several places signed and unsigned numbers were mixed, with the end result being insecure code. These flaws could be abused by remote users to write 0 bytes into rsync's memory and trick rsync into executing arbitrary code on the server.

It is recommended that all Mandrake Linux users update rsync immediately. As well, rsync server administrators should seriously consider making use of the 'use chroot', 'read only', and 'uid' options as these can significantly reduce the impact that security problems in rsync (or elsewhere) have on the server.

The remote rsync server is affected by multiple signedness errors in the I/O functions. An unauthenticated, remote attacker can exploit these to cause a denial of service or execute arbitrary code.

ID	Name	Product	Family	Severity
14943	Debian DSA-106-2 : rsync - remote exploit	Nessus	Debian Local Security Checks	critical
1897	rsync < 2.5.2 Signedness Error Array Overflow	Nessus Network Monitor	Generic	critical
13917	Mandrake Linux Security Advisory : rsync (MDKSA-2002:009)	Nessus	Mandriva Local Security Checks	critical
11390	rsync I/O Functions Multiple Signedness Errors RCE	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2002-0048

critical

Tenable Plugins

critical

critical

critical

critical