Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 27 Nov 2012 17:40:47 -0600
From: Derek Martin <>
To: Yves-Alexis Perez <>
        Russ Allbery <>,
Subject: Re: rssh: incorrect filtering of command line options

On Wed, Nov 28, 2012 at 12:21:03AM +0100, Yves-Alexis Perez wrote:
> CVE-2012-2251
> 	Incorrect filtering of command line when using rsync protocol. It was
> 	for example possible to pass dangerous options after a "--" switch. The rsync
> 	protocol support has been added in a Debian (and Fedora/Red Hat) specific
> 	patch, so this vulnerability doesn't affect upstream.
> CVE-2012-2251

I believe this one was meant to be CVE-2012-2252...

> 	Incorrect filtering of the "--rsh" option: the filter preventing usage of the
> 	"--rsh=" option would not prevent passing "--rsh". This vulnerability affects
> 	upstream code.

I've uploaded rssh-2.3.4 to the project's web page, as well as to
sourceforge.  This update includes the fix for CVE-2012-2252, and also
rolls up a fix for CVE-2012-3478, for which I had previously only
posted a patch.  Additionally there are some mostly trivial updates
for code and build clean-up.

Derek D. Martin
GPG Key ID: 0x81CFE75D

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.