rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.

The remote host is affected by the vulnerability described in GLSA-201311-19 (rssh: Access restriction bypass)

    Multiple command line parsing and validation vulnerabilities have been       discovered in rssh. Please review the CVE identifiers referenced below       for details.
  Impact :

    Multiple parsing and validation vulnerabilities can cause the       restrictions set up by rssh to be bypassed.
  Workaround :

    There is no known workaround at this time.

Update to 2.3.4 and fix CVE-2012-2251

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Derek Martin (rssh maintainer) reports :

Henrik Erkkonen has discovered that, through clever manipulation of environment variables on the ssh command line, it is possible to circumvent rssh. As far as I can tell, there is no way to effect a root compromise, except of course if the root account is the one you're attempting to protect with rssh...

Henrik Erkkonen discovered that rssh, a restricted shell for SSH, does not properly restrict shell access.

ID	Name	Product	Family	Severity
71121	GLSA-201311-19 : rssh: Access restriction bypass	Nessus	Gentoo Local Security Checks	medium
63489	Fedora 18 : rssh-2.3.4-1.fc18 (2012-20111)	Nessus	Fedora Local Security Checks	medium
63308	Fedora 17 : rssh-2.3.4-1.fc17 (2012-20109)	Nessus	Fedora Local Security Checks	medium
61617	FreeBSD : rssh -- arbitrary command execution (65b25acc-e63b-11e1-b81c-001b77d09812)	Nessus	FreeBSD Local Security Checks	low
61555	Debian DSA-2530-1 : rssh - shell command injection	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2012-3478

critical

Tenable Plugins

medium

medium

medium

low

low