CVE-2003-0962: Buffer Overflow
Published Dec 10, 2003
·Updated
Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
Affected Software
31 affected components
Andrew Tridgell Rsync=2.3.1
Andrew Tridgell Rsync=2.3.2
Andrew Tridgell Rsync=2.4.0
Andrew Tridgell Rsync=2.4.1
Andrew Tridgell Rsync=2.4.3
Andrew Tridgell Rsync=2.4.4
Andrew Tridgell Rsync=2.4.5
Andrew Tridgell Rsync=2.4.6
Andrew Tridgell Rsync=2.4.8
Andrew Tridgell Rsync=2.5.0
Andrew Tridgell Rsync=2.5.1
Andrew Tridgell Rsync=2.5.2
Andrew Tridgell Rsync=2.5.3
Andrew Tridgell Rsync=2.5.4
Andrew Tridgell Rsync=2.5.5
Andrew Tridgell Rsync=2.5.6
redhat Rsync=2.4.6-2
redhat Rsync=2.4.6-5
redhat Rsync=2.4.6-5
redhat Rsync=2.5.4-2
redhat Rsync=2.5.5-1
redhat Rsync=2.5.5-4
Engardelinux Secure Community=1.0.1
Engardelinux Secure Community=2.0
Engardelinux Secure Linux=1.1
Engardelinux Secure Linux=1.2
Engardelinux Secure Linux=1.5
Slackware Slackware Linux=8.1
Slackware Slackware Linux=9.0
Slackware Slackware Linux=9.1
Slackware Slackware Linux=current
Remediation
Patch Available
Patch Available
Event History
Dec 10, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Dec 15, 2003
Data Sourced
via NVD·05:00 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2003-0962?
CVE-2003-0962 is considered a high severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2003-0962?
To fix CVE-2003-0962, upgrade rsync to version 2.5.7 or later.
3
What versions of rsync are affected by CVE-2003-0962?
CVE-2003-0962 affects rsync versions prior to 2.5.7.
4
Can CVE-2003-0962 allow attackers to escape a chroot jail?
Yes, CVE-2003-0962 can potentially allow attackers to escape the chroot jail when exploiting the vulnerability.
5
Is rsync running in server mode vulnerable to CVE-2003-0962?
Yes, rsync running in server mode is vulnerable to CVE-2003-0962.