rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option.

Update to 2.3.4 and fix CVE-2012-2251

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned :

  - CVE-2012-2251     Incorrect filtering of command line when using rsync     protocol. It was for example possible to pass dangerous     options after a '--' switch. The rsync protocol support     has been added in a Debian (and Fedora/Red Hat) specific     patch, so this vulnerability doesn't affect upstream.

  - CVE-2012-2252     Incorrect filtering of the '--rsh' option: the filter     preventing usage of the'--rsh=' option would not prevent     passing '--rsh'. This vulnerability affects upstream     code.

ID	Name	Product	Family	Severity
63489	Fedora 18 : rssh-2.3.4-1.fc18 (2012-20111)	Nessus	Fedora Local Security Checks	medium
63308	Fedora 17 : rssh-2.3.4-1.fc17 (2012-20109)	Nessus	Fedora Local Security Checks	medium
63068	Debian DSA-2578-1 : rssh - insufficient filtering of rsync command line	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-2251

critical

Tenable Plugins

medium

medium

medium