Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.

The remote host is affected by the vulnerability described in GLSA-201311-19 (rssh: Access restriction bypass)

    Multiple command line parsing and validation vulnerabilities have been       discovered in rssh. Please review the CVE identifiers referenced below       for details.
  Impact :

    Multiple parsing and validation vulnerabilities can cause the       restrictions set up by rssh to be bypassed.
  Workaround :

    There is no known workaround at this time.

Update to 2.3.4 and fix CVE-2012-2251

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned :

  - CVE-2012-2251     Incorrect filtering of command line when using rsync     protocol. It was for example possible to pass dangerous     options after a '--' switch. The rsync protocol support     has been added in a Debian (and Fedora/Red Hat) specific     patch, so this vulnerability doesn't affect upstream.

  - CVE-2012-2252     Incorrect filtering of the '--rsh' option: the filter     preventing usage of the'--rsh=' option would not prevent     passing '--rsh'. This vulnerability affects upstream     code.

ID	Name	Product	Family	Severity
71121	GLSA-201311-19 : rssh: Access restriction bypass	Nessus	Gentoo Local Security Checks	medium
63489	Fedora 18 : rssh-2.3.4-1.fc18 (2012-20111)	Nessus	Fedora Local Security Checks	medium
63308	Fedora 17 : rssh-2.3.4-1.fc17 (2012-20109)	Nessus	Fedora Local Security Checks	medium
63068	Debian DSA-2578-1 : rssh - insufficient filtering of rsync command line	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-2252

critical

Tenable Plugins

medium

medium

medium

medium