{"id": "CVE-2004-1162", "bulletinFamily": "NVD", "title": "CVE-2004-1162", "description": "The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.", "published": "2005-01-10T00:00:00", "modified": "2017-07-10T21:30:47", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1162", "reporter": "NVD", "references": ["http://www.sublimation.org/scponly/#relnotes", "http://www.securityfocus.com/bid/11791", "http://www.gentoo.org/security/en/glsa/glsa-200412-01.xml", "https://exchange.xforce.ibmcloud.com/vulnerabilities/18362", "http://marc.info/?l=bugtraq&m=110581113814623&w=2", "http://marc.info/?l=bugtraq&m=110202047507273&w=2"], "cvelist": ["CVE-2004-1162"], "type": "cve", "lastseen": "2017-07-11T11:14:31", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:scponly:scponly:3.9", "cpe:/a:scponly:scponly:2.0", "cpe:/a:scponly:scponly:2.1", "cpe:/a:scponly:scponly:3.0", "cpe:/o:gentoo:linux", "cpe:/a:scponly:scponly:3.11", "cpe:/a:scponly:scponly:2.3", "cpe:/a:scponly:scponly:3.5", "cpe:/a:scponly:scponly:3.8", "cpe:/a:scponly:scponly:2.4"], "cvelist": ["CVE-2004-1162"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.", "edition": 1, "hash": "13d141df17faef821932c2939cfcea32d18d5424c41bff3dcf944b39d6939907", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "8204ac1e54d59577c42f737697d3beb6", "key": "href"}, {"hash": "62e7e9fb68666db12d90c56f2817db91", "key": "description"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "b4cfb015019aadf2e394f8e4d306123f", "key": "published"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "2c2d2fe722d99eaa14a30a96f5408159", "key": "title"}, {"hash": "0463ad38faa19c44fc3f64b51b457f90", "key": "cpe"}, {"hash": "ced0bbfeffb3ba1060bd76f40b1a0f3c", "key": "references"}, {"hash": "87432a9f93c678c116d87022d170b82d", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "4f914fc3cdaf564cb3dfd41793e55b35", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1162", "id": "CVE-2004-1162", "lastseen": "2016-09-03T04:33:05", "modified": "2008-09-05T16:40:34", "objectVersion": "1.2", "published": "2005-01-10T00:00:00", "references": ["http://marc.theaimsgroup.com/?l=bugtraq&m=110581113814623&w=2", "http://www.sublimation.org/scponly/#relnotes", "http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273&w=2", "http://www.securityfocus.com/bid/11791", "http://www.gentoo.org/security/en/glsa/glsa-200412-01.xml", "http://xforce.iss.net/xforce/xfdb/18362"], "reporter": "NVD", "scanner": [], "title": "CVE-2004-1162", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T04:33:05"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:scponly:scponly:3.9", "cpe:/a:scponly:scponly:2.0", "cpe:/a:scponly:scponly:2.1", "cpe:/a:scponly:scponly:3.0", "cpe:/o:gentoo:linux", "cpe:/a:scponly:scponly:3.11", "cpe:/a:scponly:scponly:2.3", "cpe:/a:scponly:scponly:3.5", "cpe:/a:scponly:scponly:3.8", "cpe:/a:scponly:scponly:2.4"], "cvelist": ["CVE-2004-1162"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.", "edition": 2, "enchantments": {}, "hash": "5a8ee9ed48d7a91c76e329c7c87734f933d9c98a5492856bfba1492e0ff10f86", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "7414d56b901edbada7fef92ae8704317", "key": "modified"}, {"hash": "8204ac1e54d59577c42f737697d3beb6", "key": "href"}, {"hash": "62e7e9fb68666db12d90c56f2817db91", "key": "description"}, {"hash": "b4cfb015019aadf2e394f8e4d306123f", "key": "published"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "2c2d2fe722d99eaa14a30a96f5408159", "key": "title"}, {"hash": "0463ad38faa19c44fc3f64b51b457f90", "key": "cpe"}, {"hash": "87432a9f93c678c116d87022d170b82d", "key": "cvelist"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "193d38fe9baab921b42e18f9543148b9", "key": "references"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1162", "id": "CVE-2004-1162", "lastseen": "2017-04-18T15:50:25", "modified": "2016-10-17T22:51:52", "objectVersion": "1.2", "published": "2005-01-10T00:00:00", "references": ["http://www.sublimation.org/scponly/#relnotes", "http://www.securityfocus.com/bid/11791", "http://www.gentoo.org/security/en/glsa/glsa-200412-01.xml", "http://xforce.iss.net/xforce/xfdb/18362", "http://marc.info/?l=bugtraq&m=110581113814623&w=2", "http://marc.info/?l=bugtraq&m=110202047507273&w=2"], "reporter": "NVD", "scanner": [], "title": "CVE-2004-1162", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-04-18T15:50:25"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "0463ad38faa19c44fc3f64b51b457f90"}, {"key": "cvelist", "hash": "87432a9f93c678c116d87022d170b82d"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "62e7e9fb68666db12d90c56f2817db91"}, {"key": "href", "hash": "8204ac1e54d59577c42f737697d3beb6"}, {"key": "modified", "hash": "45f073cee3fccc59e21543084dab4211"}, {"key": "published", "hash": "b4cfb015019aadf2e394f8e4d306123f"}, {"key": "references", "hash": "b41944fa6387209990689ae45bcee3b8"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "2c2d2fe722d99eaa14a30a96f5408159"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "f32e2e5ff7f6d254c687261957c43558a02110a15b82b840100637d0e763d13e", "viewCount": 0, "enchantments": {"vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:scponly:scponly:3.9", "cpe:/a:scponly:scponly:2.0", "cpe:/a:scponly:scponly:2.1", "cpe:/a:scponly:scponly:3.0", "cpe:/o:gentoo:linux", "cpe:/a:scponly:scponly:3.11", "cpe:/a:scponly:scponly:2.3", "cpe:/a:scponly:scponly:3.5", "cpe:/a:scponly:scponly:3.8", "cpe:/a:scponly:scponly:2.4"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"result": {"osvdb": [{"id": "OSVDB:12183", "type": "osvdb", "title": "scponly scp -S Arbitrary Remote Command Execution", "description": "## Vulnerability Description\nscponly contains a flaw that may allow a remote malicious user to bypass certain security restrictions. The issue is triggered when 'scp -S' is used with scponly. The problem is that some of the predefined applications support flags (-S), which allow command execution. It is possible that the flaw may allow an attacker to bypass the shell restriction and execute arbitrary commands resulting in a loss of integrity.\n## Solution Description\nUpgrade to version 4.0 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nscponly contains a flaw that may allow a remote malicious user to bypass certain security restrictions. The issue is triggered when 'scp -S' is used with scponly. The problem is that some of the predefined applications support flags (-S), which allow command execution. It is possible that the flaw may allow an attacker to bypass the shell restriction and execute arbitrary commands resulting in a loss of integrity.\n## References:\nVendor URL: http://www.sublimation.org/scponly/\nSecurity Tracker: 1012418\n[Secunia Advisory ID:13369](https://secuniaresearch.flexerasoftware.com/advisories/13369/)\n[Secunia Advisory ID:13364](https://secuniaresearch.flexerasoftware.com/advisories/13364/)\n[Related OSVDB ID: 12182](https://vulners.com/osvdb/OSVDB:12182)\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200412-01.xml\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-12/0020.html\nISS X-Force ID: 18362\n[CVE-2004-1162](https://vulners.com/cve/CVE-2004-1162)\n", "published": "2004-12-02T09:10:47", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:12183", "cvelist": ["CVE-2004-1162"], "lastseen": "2017-04-28T13:20:07"}], "openvas": [{"id": "OPENVAS:54760", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200412-01 (scponly)", "description": "The remote host is missing updates announced in\nadvisory GLSA 200412-01.", "published": "2008-09-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=54760", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "lastseen": "2017-07-24T12:50:02"}, {"id": "OPENVAS:52284", "type": "openvas", "title": "FreeBSD Ports: rssh", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "published": "2008-09-04T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=52284", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "lastseen": "2017-07-02T21:10:15"}], "nessus": [{"id": "FREEBSD_PKG_F11B219A44B611D9AE2F021106004FD6.NASL", "type": "nessus", "title": "FreeBSD : rssh & scponly -- arbitrary command execution (f11b219a-44b6-11d9-ae2f-021106004fd6)", "description": "Jason Wies identified both rssh & scponly have a vulnerability that allows arbitrary command execution. He reports :\n\nThe problem is compounded when you recognize that the main use of rssh and scponly is to allow file transfers, which in turn allows a malicious user to transfer and execute entire custom scripts on the remote machine.", "published": "2005-07-13T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=19165", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "lastseen": "2017-10-29T13:45:53"}, {"id": "GENTOO_GLSA-200412-01.NASL", "type": "nessus", "title": "GLSA-200412-01 : rssh, scponly: Unrestricted command execution", "description": "The remote host is affected by the vulnerability described in GLSA-200412-01 (rssh, scponly: Unrestricted command execution)\n\n Jason Wies discovered that when receiving an authorized command from an authorized user, rssh and scponly do not filter command-line options that can be used to execute any command on the target host.\n Impact :\n\n Using a malicious command, it is possible for a remote authenticated user to execute any command (or upload and execute any file) on the target machine with user rights, effectively bypassing any restriction of scponly or rssh.\n Workaround :\n\n There is no known workaround at this time.", "published": "2004-12-04T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=15903", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "lastseen": "2017-10-29T13:34:05"}], "gentoo": [{"id": "GLSA-200412-01", "type": "gentoo", "title": "rssh, scponly: Unrestricted command execution", "description": "### Background\n\nrssh and scponly are two restricted shells, allowing only a few predefined commands. They are often used as a complement to OpenSSH to provide access to remote users without providing any remote execution privileges. \n\n### Description\n\nJason Wies discovered that when receiving an authorized command from an authorized user, rssh and scponly do not filter command-line options that can be used to execute any command on the target host. \n\n### Impact\n\nUsing a malicious command, it is possible for a remote authenticated user to execute any command (or upload and execute any file) on the target machine with user rights, effectively bypassing any restriction of scponly or rssh. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll scponly users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/scponly-4.0\"\n\nAll rssh users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-shells/rssh/rssh-2.2.3\"", "published": "2004-12-03T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/200412-01", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "lastseen": "2016-09-06T19:46:43"}]}}