CVE-2004-2093

published 2004-02-09

CVE-2004-2093: Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly…

Priority P4 17 medium 4.6 CVSS 2.0

AV L AC L Au N C P I P A P

EXPLOIT

Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long RSYNC_PROXY environment variable. NOTE: since rsync is not setuid, this issue does not provide any additional privileges beyond those that are already available to the user. Therefore this issue may be REJECTED in the future.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	rsync	< rsync 2.6.1-1 (bookworm)	rsync 2.6.1-1 (bookworm)
samba	rsync	>= 0 < 2.6.1-1	2.6.1-1
samba	rsync	>= 0 < 2.6.1-1	2.6.1-1
samba	rsync	>= 0 < 2.6.1-1	2.6.1-1
samba	rsync	>= 0 < 2.6.1-1	2.6.1-1

CVSS provenance

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

osv 4.6 MEDIUM

vendor_debian 4.6 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.