FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-4091

This CVE name corresponds to:

Entered	Topic
2007-08-21	rsync -- off by one stack overflow

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2007-4091 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2007-4091
Phase	Assigned(20070730)

Description

Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.

References

Source	Reference
BUGTRAQ	20070823 FLEA-2007-0047-1 rsync
CONFIRM	http://article.gmane.org/gmane.linux.debian.devel.bugs.general/291908
CONFIRM	http://c-skills.blogspot.com/2007/08/cve-2007-4091.html
CONFIRM	https://issues.rpath.com/browse/RPL-1647
DEBIAN	DSA-1360
GENTOO	GLSA-200709-13
SLACKWARE	SSA:2007-335-01
SUSE	SUSE-SR:2007:017
TRUSTIX	2007-0026
UBUNTU	USN-500-1
BID	25336
VUPEN	ADV-2007-2915
SECUNIA	26493
SECUNIA	26518
SECUNIA	26537
SECUNIA	26548
SECUNIA	26634
SECUNIA	26543
SECUNIA	26822
SECUNIA	26911
SECUNIA	27896
XF	rsync-fname-bo(36072)