1. CVE-Search
  2. CVE-2003-0962
ID CVE-2003-0962
Summary Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
References
Vulnerable Configurations
  • cpe:2.3:a:andrew_tridgell:rsync:2.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:andrew_tridgell:rsync:2.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:andrew_tridgell:rsync:2.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:rsync:2.4.6-2:*:i386:*:*:*:*:*
    cpe:2.3:a:redhat:rsync:2.4.6-2:*:i386:*:*:*:*:*
  • cpe:2.3:a:redhat:rsync:2.4.6-5:*:i386:*:*:*:*:*
    cpe:2.3:a:redhat:rsync:2.4.6-5:*:i386:*:*:*:*:*
  • cpe:2.3:a:redhat:rsync:2.4.6-5:*:ia64:*:*:*:*:*
    cpe:2.3:a:redhat:rsync:2.4.6-5:*:ia64:*:*:*:*:*
  • cpe:2.3:a:redhat:rsync:2.5.4-2:*:i386:*:*:*:*:*
    cpe:2.3:a:redhat:rsync:2.5.4-2:*:i386:*:*:*:*:*
  • cpe:2.3:a:redhat:rsync:2.5.5-1:*:i386:*:*:*:*:*
    cpe:2.3:a:redhat:rsync:2.5.5-1:*:i386:*:*:*:*:*
  • cpe:2.3:a:redhat:rsync:2.5.5-4:*:i386:*:*:*:*:*
    cpe:2.3:a:redhat:rsync:2.5.5-4:*:i386:*:*:*:*:*
  • cpe:2.3:o:engardelinux:secure_community:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:engardelinux:secure_community:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:o:engardelinux:secure_community:2.0:*:*:*:*:*:*:*
    cpe:2.3:o:engardelinux:secure_community:2.0:*:*:*:*:*:*:*
  • cpe:2.3:o:engardelinux:secure_linux:1.1:*:professional:*:*:*:*:*
    cpe:2.3:o:engardelinux:secure_linux:1.1:*:professional:*:*:*:*:*
  • cpe:2.3:o:engardelinux:secure_linux:1.2:*:professional:*:*:*:*:*
    cpe:2.3:o:engardelinux:secure_linux:1.2:*:professional:*:*:*:*:*
  • cpe:2.3:o:engardelinux:secure_linux:1.5:*:professional:*:*:*:*:*
    cpe:2.3:o:engardelinux:secure_linux:1.5:*:professional:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:8.1:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:8.1:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:current:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:current:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 03-05-2018 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:19:16.743-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
description Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
family unix
id oval:org.mitre.oval:def:9415
status accepted
submitted 2010-07-09T03:56:16-04:00
title Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
version 30
redhat via4
advisories
rhsa
id RHSA-2003:398
rpms
  • rsync-0:2.5.7-1
  • rsync-debuginfo-0:2.5.7-1
refmap via4
bid 9153
bugtraq
  • 20031204 GLSA: exploitable heap overflow in rsync (200312-03)
  • 20031204 [OpenPKG-SA-2003.051] OpenPKG Security Advisory (rsync)
  • 20031204 rsync security advisory (fwd)
cert-vn VU#325603
conectiva CLA-2003:794
debian DSA-404
engarde ESA-20031204-032
immunix IMNX-2003-73-001-01
mandrake MDKSA-2003:111
osvdb 2898
secunia
  • 10353
  • 10354
  • 10355
  • 10356
  • 10357
  • 10358
  • 10359
  • 10360
  • 10361
  • 10362
  • 10363
  • 10364
  • 10378
  • 10474
sgi 20031202-01-U
suse SuSE-SA:2003:050
trustix 2003-0048
xf linux-rsync-heap-overflow(13899)
Last major update 03-05-2018 - 01:29
Published 15-12-2003 - 05:00
Last modified 03-05-2018 - 01:29
Back to Top