CVE-2004-0609

CVE-2004-0609 affects the rssh project (versions 2.0 through 2.1.x), where command-line arguments are expanded before entering a chroot jail. This behavior lets remote authenticated users determine the existence of files in directories outside the jail (file-name disclosure). The root cause is ar...

CVE-2004-0609

rssh 2.0 through 2.1.x expands command line arguments before entering a chroot jail, which allows remote authenticated users to determine the existence of files in a directory outside the jail...

CVE-2004-0609

Removed by vendor...

rssh protection bypass

Access outside jail is possible...

Security flaw in rssh

rssh is a small shell whose purpose is to restrict users to using scp or sftp, and also provides the facilities to place users in a chroot jail. It can also be used to lock users out of a system completely. William F. McCaw identified a minor security flaw in rssh when used with chroot jails. The...

rssh -- file name disclosure bug

rssh expands command line paramters before invoking chroot. This could result in the disclosure to the client of file names outside of the chroot directory. A posting by the rssh author explains: The cause of the problem identified by Mr. McCaw is that rssh expanded command-line arguments prior t...