Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Rsync 3.1.0 can be stalled by fake username

CVE-2014-2855 · published 12 years ago
Summary

The version of rsync up to 3.1.0 checks a user name against a secrets file. If an attacker sends a name that isn’t in the file, the program can get stuck in a loop, using up CPU and stopping the service. Upgrade rsync to a newer release or apply the provided patch to stop this behavior.

What to do
  • Update debian rsync to version 3.1.0-3.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian rsync < 3.1.0-3
Fix: upgrade to 3.1.0-3
Debian:13 debian rsync < 3.1.0-3
Fix: upgrade to 3.1.0-3
Debian:14 debian rsync < 3.1.0-3
Fix: upgrade to 3.1.0-3
– samba rsync <= 3.1.0
2.6.9
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
30 more version ranges
cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*
Original advisory text
The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist ...
The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.
References
Severity
7.8 High
Exploitation
4% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published23 Apr 2014
Updated24 Oct 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-2855 · OSV
CVE-2014-2855 · NVD
Track software like this
Free during beta