CVE-2017-16548: Critical severity Samba rsync vulnerability
Last updated 25 August 2025
Other sources
The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.1.2-2.1Fixed in 3.1.2-1+deb9u1Fixed in 3.1.1-3+deb8u1 - Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u1Fixed in 3.2.3-4+deb11u4Fixed in 3.2.7-1+deb12u6Fixed in 3.2.7-1+deb12u5Fixed in 3.4.1+ds1-5+deb13u4Fixed in 3.4.1+ds1-5+deb13u3Fixed in 3.4.4+ds1-1 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.1.2 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.1.3-development
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16548?
The severity of CVE-2017-16548 is critical with a CVSS score of 9.8.
How does CVE-2017-16548 impact rsync?
CVE-2017-16548 allows remote attackers to cause a denial of service or possibly have unspecified other impact by sending a malicious xattr name.
Which versions of rsync are affected by CVE-2017-16548?
Versions 3.1.2 and 3.1.3-development of rsync are affected by CVE-2017-16548.
Are there any remedies available for CVE-2017-16548?
Yes, there are remedies available for CVE-2017-16548. Debian has released security advisories (DSA-4068) with updated versions of rsync (3.1.3-6, 3.2.3-4+deb11u1, 3.2.7-1).
Where can I find more information about CVE-2017-16548?
More information about CVE-2017-16548 can be found on Bugzilla (https://bugzilla.samba.org/show_bug.cgi?id=13112), the rsync Git repository (https://git.samba.org/rsync.git/?p=rsync.git;a=commit;h=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1), and Debian Security Advisory DSA-4068 (https://www.debian.org/security/2017/dsa-4068).