ID CVE-2004-1162 Type cve Reporter NVD Modified 2017-07-10T21:30:47
Description
The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.
{"osvdb": [{"lastseen": "2017-04-28T13:20:07", "references": [], "edition": 1, "description": "## Vulnerability Description\nscponly contains a flaw that may allow a remote malicious user to bypass certain security restrictions. The issue is triggered when 'scp -S' is used with scponly. The problem is that some of the predefined applications support flags (-S), which allow command execution. It is possible that the flaw may allow an attacker to bypass the shell restriction and execute arbitrary commands resulting in a loss of integrity.\n## Solution Description\nUpgrade to version 4.0 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nscponly contains a flaw that may allow a remote malicious user to bypass certain security restrictions. The issue is triggered when 'scp -S' is used with scponly. The problem is that some of the predefined applications support flags (-S), which allow command execution. It is possible that the flaw may allow an attacker to bypass the shell restriction and execute arbitrary commands resulting in a loss of integrity.\n## References:\nVendor URL: http://www.sublimation.org/scponly/\nSecurity Tracker: 1012418\n[Secunia Advisory ID:13369](https://secuniaresearch.flexerasoftware.com/advisories/13369/)\n[Secunia Advisory ID:13364](https://secuniaresearch.flexerasoftware.com/advisories/13364/)\n[Related OSVDB ID: 12182](https://vulners.com/osvdb/OSVDB:12182)\nOther Advisory URL: http://security.gentoo.org/glsa/glsa-200412-01.xml\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-12/0020.html\nISS X-Force ID: 18362\n[CVE-2004-1162](https://vulners.com/cve/CVE-2004-1162)\n", "reporter": "Jason Wies(jason@xc.net)", "published": "2004-12-02T09:10:47", "type": "osvdb", "title": "scponly scp -S Arbitrary Remote Command Execution", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "scponly", "version": "3.7", "operator": "eq"}, {"name": "scponly", "version": "3.2", "operator": "eq"}, {"name": "scponly", "version": "3.3", "operator": "eq"}, {"name": "scponly", "version": "3.6", "operator": "eq"}, {"name": "scponly", "version": "3.1", "operator": "eq"}, {"name": "scponly", "version": "3.11", "operator": "eq"}, {"name": "scponly", "version": "3.9", "operator": "eq"}, {"name": "scponly", "version": "3.8", "operator": "eq"}, {"name": "scponly", "version": "3.4", "operator": "eq"}], "cvelist": ["CVE-2004-1162"], "modified": "2004-12-02T09:10:47", "href": "https://vulners.com/osvdb/OSVDB:12183", "id": "OSVDB:12183", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:43", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1161", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1162", "http://www.securityfocus.com/archive/1/383046/2004-11-30/2004-12-06/0", "https://bugs.gentoo.org/show_bug.cgi?id=72816", "https://bugs.gentoo.org/show_bug.cgi?id=72815"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "4.0", "arch": "all", "packageFilename": "UNKNOWN", "packageName": "net-misc/scponly", "operator": "lt"}, {"OS": "Gentoo", "OSVersion": "any", "packageVersion": "2.2.2", "arch": "all", "packageFilename": "UNKNOWN", "packageName": "app-shells/rssh", "operator": "le"}], "edition": 1, "description": "### Background\n\nrssh and scponly are two restricted shells, allowing only a few predefined commands. They are often used as a complement to OpenSSH to provide access to remote users without providing any remote execution privileges. \n\n### Description\n\nJason Wies discovered that when receiving an authorized command from an authorized user, rssh and scponly do not filter command-line options that can be used to execute any command on the target host. \n\n### Impact\n\nUsing a malicious command, it is possible for a remote authenticated user to execute any command (or upload and execute any file) on the target machine with user rights, effectively bypassing any restriction of scponly or rssh. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll scponly users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/scponly-4.0\"\n\nAll rssh users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-shells/rssh/rssh-2.2.3\"", "reporter": "Gentoo Foundation", "published": "2004-12-03T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "gentoo", "title": "rssh, scponly: Unrestricted command execution", "bulletinFamily": "unix", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "modified": "2006-05-22T00:00:00", "id": "GLSA-200412-01", "href": "https://security.gentoo.org/glsa/200412-01", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-24T12:50:02", "references": [], "pluginID": "54760", "description": "The remote host is missing updates announced in\nadvisory GLSA 200412-01.", "edition": 2, "reporter": "Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com", "published": "2008-09-24T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Gentoo Security Advisory GLSA 200412-01 (scponly)", "type": "openvas", "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "modified": "2017-07-07T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=54760", "id": "OPENVAS:54760", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"rssh and scponly do not filter command-line options that can be exploited\nto execute any command, thereby allowing a remote user to completely\nbypass the restricted shell.\";\ntag_solution = \"All scponly users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/scponly-4.0'\n\nAll rssh users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-shells/rssh/rssh-2.2.3'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200412-01\nhttp://bugs.gentoo.org/show_bug.cgi?id=72815\nhttp://bugs.gentoo.org/show_bug.cgi?id=72816\nhttp://www.securityfocus.com/archive/1/383046/2004-11-30/2004-12-06/0\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200412-01.\";\n\n \n\nif(description)\n{\n script_id(54760);\n script_cve_id(\"CVE-2004-1161\",\"CVE-2004-1162\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_name(\"Gentoo Security Advisory GLSA 200412-01 (scponly)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"net-misc/scponly\", unaffected: make_list(\"ge 4.0\"), vulnerable: make_list(\"lt 4.0\"))) != NULL) {\n report += res;\n}\nif ((res = ispkgvuln(pkg:\"app-shells/rssh\", unaffected: make_list(\"ge 2.2.3\"), vulnerable: make_list(\"le 2.2.2\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:10:15", "references": [], "pluginID": "52284", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "edition": 1, "reporter": "Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com", "published": "2008-09-04T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "FreeBSD Ports: rssh", "type": "openvas", "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "modified": "2016-09-28T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=52284", "id": "OPENVAS:52284", "sourceData": "#\n#VID f11b219a-44b6-11d9-ae2f-021106004fd6\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n rssh\n scponly\n\nCVE-2004-1161:\nThe installed version of rssh does not properly\nrestrict programs that can be run, which could\nallow remote authenticated users to bypass intended\naccess restrictions and execute arbitrary programs\nvia (1) rdist -P, (2) rsync, or (3) scp -S.\n\nCVE-2004-1162:\nThe unison command in scponly before 4.0 does not\nproperly restrict programs that can be run, which\ncould allow remote authenticated users to bypass\nintended access restrictions and execute arbitrary\nprograms via the (1) -rshcmd or (2) -sshcmd flags.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273\nhttp://www.vuxml.org/freebsd/f11b219a-44b6-11d9-ae2f-021106004fd6.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52284);\n script_version(\"$Revision: 4164 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-28 09:03:16 +0200 (Wed, 28 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_bugtraq_id(11791,11792);\n script_cve_id(\"CVE-2004-1161\", \"CVE-2004-1162\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"FreeBSD Ports: rssh\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"rssh\");\nif(!isnull(bver) && revcomp(a:bver, b:\"2.2.2\")<=0) {\n txt += 'Package rssh version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"scponly\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.0\")<0) {\n txt += 'Package scponly version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-09-02T00:10:24", "references": ["http://marc.info/?l=bugtraq&m=110202047507273", "http://www.nessus.org/u?371f7435", "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=74633"], "pluginID": "19165", "description": "Jason Wies identified both rssh & scponly have a vulnerability that allows arbitrary command execution. He reports :\n\nThe problem is compounded when you recognize that the main use of rssh and scponly is to allow file transfers, which in turn allows a malicious user to transfer and execute entire custom scripts on the remote machine.", "edition": 4, "reporter": "Tenable", "published": "2005-07-13T00:00:00", "title": "FreeBSD : rssh & scponly -- arbitrary command execution (f11b219a-44b6-11d9-ae2f-021106004fd6)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "modified": "2014-09-18T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:scponly", "p-cpe:/a:freebsd:freebsd:rssh"], "id": "FREEBSD_PKG_F11B219A44B611D9AE2F021106004FD6.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=19165", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2014 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(19165);\n script_version(\"$Revision: 1.22 $\");\n script_cvs_date(\"$Date: 2014/09/18 13:33:38 $\");\n\n script_cve_id(\"CVE-2004-1161\", \"CVE-2004-1162\");\n script_bugtraq_id(11791, 11792);\n\n script_name(english:\"FreeBSD : rssh & scponly -- arbitrary command execution (f11b219a-44b6-11d9-ae2f-021106004fd6)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Jason Wies identified both rssh & scponly have a vulnerability that\nallows arbitrary command execution. He reports :\n\nThe problem is compounded when you recognize that the main use of rssh\nand scponly is to allow file transfers, which in turn allows a\nmalicious user to transfer and execute entire custom scripts on the\nremote machine.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=74633\"\n );\n # http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://marc.info/?l=bugtraq&m=110202047507273\"\n );\n # http://www.freebsd.org/ports/portaudit/f11b219a-44b6-11d9-ae2f-021106004fd6.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?371f7435\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:rssh\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:scponly\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2004/11/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2004/12/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"rssh<=2.2.2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"scponly<4.0\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:34:45", "references": ["https://security.gentoo.org/glsa/200412-01", "http://www.securityfocus.com/archive/1/383046/2004-11-30/2004-12-06/0"], "pluginID": "15903", "description": "The remote host is affected by the vulnerability described in GLSA-200412-01 (rssh, scponly: Unrestricted command execution)\n\n Jason Wies discovered that when receiving an authorized command from an authorized user, rssh and scponly do not filter command-line options that can be used to execute any command on the target host.\n Impact :\n\n Using a malicious command, it is possible for a remote authenticated user to execute any command (or upload and execute any file) on the target machine with user rights, effectively bypassing any restriction of scponly or rssh.\n Workaround :\n\n There is no known workaround at this time.", "edition": 5, "reporter": "Tenable", "published": "2004-12-04T00:00:00", "title": "GLSA-200412-01 : rssh, scponly: Unrestricted command execution", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2004-1162", "CVE-2004-1161"], "modified": "2018-08-10T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:rssh", "p-cpe:/a:gentoo:linux:scponly"], "id": "GENTOO_GLSA-200412-01.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=15903", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200412-01.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(15903);\n script_version(\"1.16\");\n script_cvs_date(\"Date: 2018/08/10 18:07:05\");\n\n script_cve_id(\"CVE-2004-1161\", \"CVE-2004-1162\");\n script_xref(name:\"GLSA\", value:\"200412-01\");\n\n script_name(english:\"GLSA-200412-01 : rssh, scponly: Unrestricted command execution\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200412-01\n(rssh, scponly: Unrestricted command execution)\n\n Jason Wies discovered that when receiving an authorized command from an\n authorized user, rssh and scponly do not filter command-line options\n that can be used to execute any command on the target host.\n \nImpact :\n\n Using a malicious command, it is possible for a remote authenticated\n user to execute any command (or upload and execute any file) on the\n target machine with user rights, effectively bypassing any restriction\n of scponly or rssh.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.securityfocus.com/archive/1/383046/2004-11-30/2004-12-06/0\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200412-01\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All scponly users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/scponly-4.0'\n All rssh users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-shells/rssh/rssh-2.2.3'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:rssh\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:scponly\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2004/12/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2004/12/04\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2004/12/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-misc/scponly\", unaffected:make_list(\"ge 4.0\"), vulnerable:make_list(\"lt 4.0\"))) flag++;\nif (qpkg_check(package:\"app-shells/rssh\", unaffected:make_list(\"ge 2.2.3\"), vulnerable:make_list(\"le 2.2.2\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rssh / scponly\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}
