Vulnerability Report

CVE-2007-4091

RCE

Title: Rsync RCE

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2007-4091.

CWE Category NVD-CWE-noinfo

Published Date Aug 16, 2007

Modified Date Jun 16, 2026

Exploit Status Not Found

Score 6.8 CVSS v2.0

Exploit Probability (EPSS)

3.34%

Vulnerability Summary

CVE-2007-4091: Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.

Impacted Vendors

andrew_tridgell 1

redhat 1

rsync 1

Reference Links

http://article.gmane.org/gmane.linux.debian.devel.bugs.general/291908 http://c-skills.blogspot.com/2007/08/cve-2007-4091.html http://secunia.com/advisories/26493 http://secunia.com/advisories/26518 http://secunia.com/advisories/26537 http://secunia.com/advisories/26543 http://secunia.com/advisories/26548 http://secunia.com/advisories/26634 http://secunia.com/advisories/26822 http://secunia.com/advisories/26911 http://secunia.com/advisories/27896 http://secunia.com/advisories/61039 http://security.gentoo.org/glsa/glsa-200709-13.xml http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.481089 http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15548.html http://www.debian.org/security/2007/dsa-1360 http://www.novell.com/linux/security/advisories/2007_17_sr.html http://www.securityfocus.com/archive/1/477628/100/0/threaded http://www.securityfocus.com/bid/25336 http://www.trustix.org/errata/2007/0026/ http://www.ubuntu.com/usn/usn-500-1 http://www.vupen.com/english/advisories/2007/2915 https://exchange.xforce.ibmcloud.com/vulnerabilities/36072 https://issues.rpath.com/browse/RPL-1647 http://article.gmane.org/gmane.linux.debian.devel.bugs.general/291908 http://c-skills.blogspot.com/2007/08/cve-2007-4091.html http://secunia.com/advisories/26493 http://secunia.com/advisories/26518 http://secunia.com/advisories/26537 http://secunia.com/advisories/26543 http://secunia.com/advisories/26548 http://secunia.com/advisories/26634 http://secunia.com/advisories/26822 http://secunia.com/advisories/26911 http://secunia.com/advisories/27896 http://secunia.com/advisories/61039 http://security.gentoo.org/glsa/glsa-200709-13.xml http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.481089 http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15548.html http://www.debian.org/security/2007/dsa-1360 http://www.novell.com/linux/security/advisories/2007_17_sr.html http://www.securityfocus.com/archive/1/477628/100/0/threaded http://www.securityfocus.com/bid/25336 http://www.trustix.org/errata/2007/0026/ http://www.ubuntu.com/usn/usn-500-1 http://www.vupen.com/english/advisories/2007/2915 https://exchange.xforce.ibmcloud.com/vulnerabilities/36072 https://issues.rpath.com/browse/RPL-1647

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.8

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2007-4091 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

August 16, 2007 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.