Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by
    rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the
    execution of arbitrary shell commands. (CVE-2019-3464)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a
    restricted shell that should restrict users to perform only rsync operations, resulting in the execution
    of arbitrary shell commands. (CVE-2019-3463)

  - Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by
    rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the
    execution of arbitrary shell commands. (CVE-2019-3464)

  - rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command
    ('Command Injection') vulnerability in allowscp permission that can result in Local command execution.
    This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
    (CVE-2019-1000018)

The remote host is affected by the vulnerability described in GLSA-202007-29 (rssh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in rssh. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Insufficient sanitation of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3464)

Insufficient sanitation of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3463)

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in 'allowscp' permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the 'allowscp' permission. (CVE-2019-1000018)

Fix CVE-2019-3463, CVE-2019-3464 and CVE-2019-1000018.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3946-1 advisory.

    It was discovered that rssh incorrectly handled certain command-line arguments and environment variables.
    An authenticated user could bypass rssh's command restrictions, allowing an attacker to run arbitrary     commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

NVD reports :

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

Nick Cleaton discovered two vulnerabilities in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the rsync support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.

ID	Name	Product	Family	Severity
424445	Alpine: rssh: security update to 2.3.4-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424445	Alpine: rssh: security update to 2.3.4-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400195	Alpine: multiple rssh packages: security update to 2.3.4-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400195	Alpine: multiple rssh packages: security update to 2.3.4-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
138952	GLSA-202007-29 : rssh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
132323	Amazon Linux AMI : rssh (ALAS-2019-1328)	Nessus	Amazon Linux Local Security Checks	critical
130801	Fedora 31 : rssh (2019-e47add6b2b)	Nessus	Fedora Local Security Checks	critical
130796	Fedora 30 : rssh (2019-d1487c13ac)	Nessus	Fedora Local Security Checks	critical
130794	Fedora 29 : rssh (2019-bfb407659e)	Nessus	Fedora Local Security Checks	critical
124019	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : rssh vulnerabilities (USN-3946-1)	Nessus	Ubuntu Local Security Checks	critical
122658	FreeBSD : rssh - multiple vulnerabilities (d193aa9f-3f8c-11e9-9a24-6805ca0b38e8)	Nessus	FreeBSD Local Security Checks	critical
121560	Debian DSA-4382-1 : rssh - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-3464

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical