scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp, as implemented by OpenSSH, with the -F and -o options.

- Wed Feb 13 2008 Tomas Hoger <thoger at redhat.com> -     4.6-10

    - Add patch to prevent restriction bypass using       OpenSSH's scp options -F and -o (CVE-2007-6415,       #426072)

  - Mon Feb 11 2008 Warren Togami <wtogami at redhat.com> -     4.6-9

    - rebuild with gcc-4.3

    - Tue Dec 11 2007 Toshio Kuratomi <a.badger at       gmail.com> - 4.6-8

    - Disable rsync support due to security concerns: RH       BZ#418201

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Feb 13 2008 Tomas Hoger <thoger at redhat.com> -     4.6-10

    - Add patch to prevent restriction bypass using       OpenSSH's scp options -F and -o (CVE-2007-6415,       #426072)

  - Mon Feb 11 2008 Warren Togami <wtogami at redhat.com> -     4.6-9

    - rebuild with gcc-4.3

    - Tue Dec 11 2007 Toshio Kuratomi <a.badger at       gmail.com> - 4.6-8

    - Disable rsync support due to security concerns: RH       BZ#418201

    - Tue Aug 21 2007 Warren Togami <wtogami at redhat.com>
      - 4.6-7

    - rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200802-06 (scponly: Multiple vulnerabilities)

    Joachim Breitner reported that Subversion and rsync support invokes     subcommands in an insecure manner (CVE-2007-6350). It has also been     discovered that scponly does not filter the -o and -F options to the     scp executable (CVE-2007-6415).
  Impact :

    A local attacker could exploit these vulnerabilities to elevate     privileges and execute arbitrary commands on the vulnerable host.
  Workaround :

    There is no known workaround at this time.

Joachim Breitner discovered that Subversion support in scponly is inherently insecure, allowing execution of arbitrary commands. Further investigation showed that rsync and Unison support suffer from similar issues. This set of issues has been assigned CVE-2007-6350.

In addition, it was discovered that it was possible to invoke scp with certain options that may lead to the execution of arbitrary commands (CVE-2007-6415 ).

This update removes Subversion, rsync and Unison support from the scponly package, and prevents scp from being invoked with the dangerous options.

ID	Name	Product	Family	Severity
31108	Fedora 8 : scponly-4.6-10.fc8 (2008-1743)	Nessus	Fedora Local Security Checks	high
31106	Fedora 7 : scponly-4.6-10.fc7 (2008-1728)	Nessus	Fedora Local Security Checks	high
31084	GLSA-200802-06 : scponly: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
30065	Debian DSA-1473-1 : scponly - design flaw	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-6415

high

Tenable Plugins

high

high

high

high