CVE-2008-1720 Memory corruption in n/a
Remote attackers can execute arbitrary code via a buffer overflow in rsync when extended attribute support is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-1720?
CVE-2008-1720 is a high-severity memory corruption vulnerability in n/a, published on 10 Apr 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.
Weakness: CWE-119
Which versions are affected by CVE-2008-1720?
It affects 1 product.
Products include Samba Rsync.
How do I fix CVE-2008-1720?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2008-1720 being exploited?
There is no known exploitation of CVE-2008-1720 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-15994 Security feature bypass in n/a
- CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
- CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
- CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
- CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
Sources
Also known as DEBIAN-CVE-2008-1720, DSA-1545-1, GHSA-m92h-xg74-c2hm.