Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.

An off by one buffer overflow within the f_name() function has been fixed. CVE-2007-4091 has been assigned to this issue.

New rsync packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.

Sebastian Krahmer discovered that rsync contained an off-by-one miscalculation when handling certain file paths. By creating a specially crafted tree of files and tricking an rsync server into processing them, a remote attacker could write a single NULL to stack memory, possibly leading to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200709-13 (rsync: Two buffer overflows)

    Sebastian Krahmer from the SUSE Security Team discovered two off-by-one     errors in the function 'f_name()' in file sender.c when processing     overly long directory names.
  Impact :

    A remote attacker could entice a user to synchronize a repository     containing specially crafted directories, leading to the execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Sebastian Krahmer discovered that rsync, a fast remote file copy program, contains an off-by-one error which might allow remote attackers to execute arbitrary code via long directory names.

BugTraq reports :

The rsync utility is prone to an off-by-one buffer-overflow vulnerability. This issue is due to a failure of the application to properly bounds-check user-supplied input.

Successfully exploiting this issue may allow arbitrary code-execution in the context of the affected utility.

ID	Name	Product	Family	Severity
78193	F5 Networks BIG-IP : Rsync sender.c vulnerability (SOL15548)	Nessus	F5 Networks Local Security Checks	medium
29569	SuSE 10 Security Update : rsync (ZYPP Patch Number 3997)	Nessus	SuSE Local Security Checks	medium
29188	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : rsync (SSA:2007-335-01)	Nessus	Slackware Local Security Checks	medium
28103	Ubuntu 6.06 LTS / 6.10 / 7.04 : rsync vulnerability (USN-500-1)	Nessus	Ubuntu Local Security Checks	medium
27420	openSUSE 10 Security Update : rsync (rsync-3996)	Nessus	SuSE Local Security Checks	medium
26103	GLSA-200709-13 : rsync: Two buffer overflows	Nessus	Gentoo Local Security Checks	medium
25960	Debian DSA-1360-1 : rsync - buffer overflow	Nessus	Debian Local Security Checks	medium
25942	FreeBSD : rsync -- off by one stack overflow (af8e3a0c-5009-11dc-8a43-003048705d5a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-4091

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium