rsync I/O Functions Multiple Signedness Errors RCE

critical Nessus Plugin ID 11390

Synopsis

Arbitrary code can be run on the remote server.

Description

The remote rsync server is affected by multiple signedness errors in the I/O functions. An unauthenticated, remote attacker can exploit these to cause a denial of service or execute arbitrary code.

Solution

Upgrade to rsync version 2.5.2 or later.

Plugin Details

Severity: Critical

ID: 11390

File Name: rsync_array_overflow.nasl

Version: 1.18

Type: remote

Family: Gain a shell remotely

Published: 3/14/2003

Updated: 7/27/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/25/2002

Reference Information

CVE: CVE-2002-0048

BID: 3958

CERT: 800635

Detections

Analytics