Date: Fri, 10 Aug 2012 13:53:39 -0700 From: Russ Allbery <rra@...nford.edu> To: oss-security@...ts.openwall.com Subject: CVE Request: rssh command-line parsing vulnerability Hello all, I'm the Debian maintainer of the rssh package, which has a security vulnerability in its command-line parsing disclosed some time back on the rssh mailing list and on BUGTRAQ. I'm preparing a security update for Debian and would like a CVE for tracking purposes. The security advisory from the upstream maintainer is at: http://sourceforge.net/mailarchive/message.php?msg_id=29235647 Here are the relevant contents: | rssh is a shell for restricting SSH access to a machine to only scp, | sftp, or a small set of similar applications. | | http://www.pizzashack.org/rssh/ | | Henrik Erkkonen has discovered that, through clever manipulation of | environment variables on the ssh command line, it is possible to | circumvent rssh. As far as I can tell, there is no way to effect a | root compromise, except of course if the root account is the one | you're attempting to protect with rssh... | [...] | | Note in particular that ensuring that the AcceptEnv sshd configuration | option need not be turned on for this exploit to work. I think this would fit the definition of "local privilege escalation" in that it allows users with a restricted shell to run commands they shouldn't be able to run. The last two messages on the thread linked above contain a patch. (Be aware that they've been mangled by the Sourceforge mailing list archive, so you have to download them to see them.) There has been no subsequent formal release, just the patch in that thread. -- Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.