Vulnerability in Andrew Tridgell Rsync
CVE-2003-0962
Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.235 (97.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.212 · newest: 0.235 · change: +0.024
Affected products
- Andrew Tridgell Rsync — versions 2.3.1, 2.3.2, 2.4.0
- Engardelinux Secure Community — versions 1.0.1, 2.0
- Engardelinux Secure Linux — versions 1.1, 1.2, 1.5
- Slackware Linux — versions 8.1, 9.0, 9.1
- Red Hat Rsync — versions 2.4.6-2, 2.4.6-5, 2.5.4-2
Public proof-of-concept exploits
References
- marc.info/ (mailing-list)
- marc.info/ (vendor-advisory)
- secunia.com/advisories/10362 (third-party-advisory)
- secunia.com/advisories/10364 (third-party-advisory)
- secunia.com/advisories/10354 (third-party-advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/13899 (vdb-entry)
- secunia.com/advisories/10363 (third-party-advisory)
- secunia.com/advisories/10353 (third-party-advisory)
- secunia.com/advisories/10357 (third-party-advisory)
- secunia.com/advisories/10355 (third-party-advisory)
Frequently asked questions
- What is CVE-2003-0962?
- CVE-2003-0962 is a vulnerability in Andrew Tridgell Rsync. Published 2003-12-15.
- Is CVE-2003-0962 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.