[Full-Disclosure] [ GLSA 200412-01 ] rssh, scponly: Unrestricted command execution

From: Thierry Carrez (koon_at_gentoo.org)
Date: 12/03/04

  • Next message: idlabs-advisories_at_idefense.com: "[Full-Disclosure] iDEFENSE Security Advisory 12.03.2004: Apple Darwin Streaming Server DESCRIBE Null Byte Denial of Service Vulnerability" 
    To: gentoo-announce@lists.gentoo.org
Date: Fri, 03 Dec 2004 17:47:18 +0100

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200412-01
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Normal
         Title: rssh, scponly: Unrestricted command execution
          Date: December 03, 2004
          Bugs: #72815, #72816
            ID: 200412-01

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    rssh and scponly do not filter command-line options that can be
    exploited to execute any command, thereby allowing a remote user to
    completely bypass the restricted shell.

    Background
    ==========

    rssh and scponly are two restricted shells, allowing only a few
    predefined commands. They are often used as a complement to OpenSSH to
    provide access to remote users without providing any remote execution
    privileges.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 net-misc/scponly < 4.0 >= 4.0
      2 app-shells/rssh <= 2.2.2 Vulnerable!
        -------------------------------------------------------------------
         NOTE: Certain packages are still vulnerable. Users should migrate
               to another package if one is available or wait for the
               existing packages to be marked stable by their
               architecture maintainers.
        -------------------------------------------------------------------
         2 affected packages on all of their supported architectures.
        -------------------------------------------------------------------

    Description
    ===========

    Jason Wies discovered that when receiving an authorized command from an
    authorized user, rssh and scponly do not filter command-line options
    that can be used to execute any command on the target host.

    Impact
    ======

    Using a malicious command, it is possible for a remote authenticated
    user to execute any command (or upload and execute any file) on the
    target machine with user rights, effectively bypassing any restriction
    of scponly or rssh.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All scponly users should upgrade to the latest version:

        # emerge --sync
        # emerge --ask --oneshot --verbose ">=net-misc/scponly-4.0"

    Currently, there is no released version of rssh that contains a fix for
    these issues. The author declared that he cannot provide a fixed
    version at this time. Therefore, the rssh package has been hard-masked
    prior to complete removal from Portage, and current users are advised
    to unmerge the package.

    References
    ==========

      [ 1 ] BugTraq Posting

    http://www.securityfocus.com/archive/1/383046/2004-11-30/2004-12-06/0

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

      http://security.gentoo.org/glsa/glsa-200412-01.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/2.0

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: idlabs-advisories_at_idefense.com: "[Full-Disclosure] iDEFENSE Security Advisory 12.03.2004: Apple Darwin Streaming Server DESCRIBE Null Byte Denial of Service Vulnerability"

    Relevant Pages

    • [ GLSA 200412-01 ] rssh, scponly: Unrestricted command execution
      ... rssh and scponly do not filter command-line options that can be ... exploited to execute any command, thereby allowing a remote user to ... that can be used to execute any command on the target host. ...
      (Full-Disclosure)
    • [ GLSA 200412-01 ] rssh, scponly: Unrestricted command execution
      ... rssh and scponly do not filter command-line options that can be ... exploited to execute any command, thereby allowing a remote user to ... that can be used to execute any command on the target host. ...
      (Bugtraq)
    • [Full-Disclosure] Advanced usage of system() function.
      ... and call its arguments as a command for shell. ... as we can see we still didnt get what we want (typing exit ... Connection closed by foreign host. ... think what we want to execute. ...
      (Full-Disclosure)
    • Advanced usage of system() function.
      ... and call its arguments as a command for shell. ... as we can see we still didnt get what we want (typing exit we are ... Connection closed by foreign host. ... think what we want to execute. ...
      (Bugtraq)
    • Re: Wait for background processes to complete
      ... To be able to execute commands in the background and wait for their ... The documentation I am referring to is http://perldoc.perl.org/. ... You can run a command in the background with: ... There is a general problem with perl documentation: ...
      (comp.lang.perl.misc)
    • Quantcast