Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

The remote host is affected by the vulnerability described in GLSA-202007-29 (rssh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in rssh. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Insufficient sanitation of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3464)

Insufficient sanitation of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3463)

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in 'allowscp' permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the 'allowscp' permission. (CVE-2019-1000018)

Fix CVE-2019-3463, CVE-2019-3464 and CVE-2019-1000018.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that rssh incorrectly handled certain command-line arguments and environment variables. An authenticated user could bypass rssh's command restrictions, allowing an attacker to run arbitrary commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NVD reports :

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

Nick Cleaton discovered two vulnerabilities in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the rsync support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.

ID	Name	Product	Family	Severity
138952	GLSA-202007-29 : rssh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
132323	Amazon Linux AMI : rssh (ALAS-2019-1328)	Nessus	Amazon Linux Local Security Checks	critical
130801	Fedora 31 : rssh (2019-e47add6b2b)	Nessus	Fedora Local Security Checks	critical
130796	Fedora 30 : rssh (2019-d1487c13ac)	Nessus	Fedora Local Security Checks	critical
130794	Fedora 29 : rssh (2019-bfb407659e)	Nessus	Fedora Local Security Checks	critical
124019	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : rssh vulnerabilities (USN-3946-1)	Nessus	Ubuntu Local Security Checks	critical
122658	FreeBSD : rssh - multiple vulnerabilities (d193aa9f-3f8c-11e9-9a24-6805ca0b38e8)	Nessus	FreeBSD Local Security Checks	critical
121560	Debian DSA-4382-1 : rssh - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-3464

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical