vendor:
rsync
by:
sorbo
7.5
CVSS
HIGH
Stack Corruption
125
CWE
Product Name: rsync
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE: a:rsync_project:rsync
Platforms Tested: Linux
Remote Code Execution in rsync
A vulnerability exists within some versions of rsync. Under some circumstances, a remotely supplied signed value is used as an array index, allowing NULL bytes to be written to arbitrary memory locations. Exploitation of this vulnerability could lead to the corruption of the stack, and possibly to execution of arbitrary code as the root user.
Mitigation:
Apply the latest patch or upgrade to a non-vulnerable version of rsync.