CVE-2006-2083
published 2006-04-28CVE-2006-2083: Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary…
PriorityP432high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.63%
88.4th percentile
Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| andrew_tridgell | rsync | — | — |
| debian | rsync | < rsync 2.6.8-1 (bookworm) | rsync 2.6.8-1 (bookworm) |
| samba | rsync | >= 0 < 2.6.8-1 | 2.6.8-1 |
| samba | rsync | >= 0 < 2.6.8-1 | 2.6.8-1 |
| samba | rsync | >= 0 < 2.6.8-1 | 2.6.8-1 |
| samba | rsync | >= 0 < 2.6.8-1 | 2.6.8-1 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2006-2083 rsync buffer overflow issue
vendor_redhat·2006-04-22·CVSS 7.5
CVE-2006-2083 [HIGH] CVE-2006-2083 rsync buffer overflow issue
CVE-2006-2083 rsync buffer overflow issue
Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.
Statement: Not vulnerable. This issue does not affect the versions of rsync distributed with Red Hat Enterprise Linux 2.1, 3, or 4.
Debian
CVE-2006-2083: rsync - Integer overflow in the receive_xattr function in the extended attributes patch ...
vendor_debian·2006·CVSS 7.5
CVE-2006-2083 [HIGH] CVE-2006-2083: rsync - Integer overflow in the receive_xattr function in the extended attributes patch ...
Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.
Scope: local
bookworm: resolved (fixed in 2.6.8-1)
bullseye: resolved (fixed in 2.6.8-1)
forky: resolved (fixed in 2.6.8-1)
sid: resolved (fixed in 2.6.8-1)
trixie: resolved (fixed in 2.6.8-1)
GHSA
GHSA-6vv2-q3g6-6w2x: Integer overflow in the receive_xattr function in the extended attributes patch (xattr
ghsa_unreviewed·2022-05-01
CVE-2006-2083 [HIGH] GHSA-6vv2-q3g6-6w2x: Integer overflow in the receive_xattr function in the extended attributes patch (xattr
Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.
OSV
CVE-2006-2083: Integer overflow in the receive_xattr function in the extended attributes patch (xattr
osv·2006-04-28·CVSS 7.5
CVE-2006-2083 [HIGH] CVE-2006-2083: Integer overflow in the receive_xattr function in the extended attributes patch (xattr
Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-2083 rsync buffer overflow issue
bugzilla·2006-04-28·CVSS 7.5
CVE-2006-2083 [HIGH] CVE-2006-2083 rsync buffer overflow issue
CVE-2006-2083 rsync buffer overflow issue
rsync buffer overflow issue
The receive_xattr() function creates a buffer by adding two integer
variables together without verifying the resultant sum hasn't caused
an integer overflow.
The fix, which is a patch of a patch is here:
http://cvs.samba.org/cgi-bin/cvsweb/rsync/patches/xattrs.diff.diff?r1=1.23&r2=1.24
Only the last few lines matter for this patch, the rest is the result
of making a minor modification in a patch.
This issue also affects FC4
Bugzilla
CVE-2006-2083 rsync buffer overflow issue
bugzilla·2006-04-28·CVSS 7.5
CVE-2006-2083 [HIGH] CVE-2006-2083 rsync buffer overflow issue
CVE-2006-2083 rsync buffer overflow issue
rsync buffer overflow issue
The receive_xattr() function creates a buffer by adding two integer
variables together without verifying the resultant sum hasn't caused
an integer overflow.
The fix, which is a patch of a patch is here:
http://cvs.samba.org/cgi-bin/cvsweb/rsync/patches/xattrs.diff.diff?r1=1.23&r2=1.24
Only the last few lines matter for this patch, the rest is the result
of making a minor modification in a patch.
http://samba.anu.edu.au/ftp/rsync/rsync-2.6.8-NEWShttp://secunia.com/advisories/19920http://secunia.com/advisories/19964http://secunia.com/advisories/20011http://www.gentoo.org/security/en/glsa/glsa-200605-05.xmlhttp://www.securityfocus.com/bid/17788http://www.trustix.org/errata/2006/0024http://www.vupen.com/english/advisories/2006/1606https://exchange.xforce.ibmcloud.com/vulnerabilities/26208http://samba.anu.edu.au/ftp/rsync/rsync-2.6.8-NEWShttp://secunia.com/advisories/19920http://secunia.com/advisories/19964http://secunia.com/advisories/20011http://www.gentoo.org/security/en/glsa/glsa-200605-05.xmlhttp://www.securityfocus.com/bid/17788http://www.trustix.org/errata/2006/0024http://www.vupen.com/english/advisories/2006/1606https://exchange.xforce.ibmcloud.com/vulnerabilities/26208
2006-04-28
Published