rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

The remote host is affected by the vulnerability described in GLSA-202007-29 (rssh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in rssh. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Insufficient sanitation of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3464)

Insufficient sanitation of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3463)

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in 'allowscp' permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the 'allowscp' permission. (CVE-2019-1000018)

Fix CVE-2019-3463, CVE-2019-3464 and CVE-2019-1000018.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3946-1 advisory.

    It was discovered that rssh incorrectly handled certain command-line arguments and environment variables.
    An authenticated user could bypass rssh's command restrictions, allowing an attacker to run arbitrary     commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

NVD reports :

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

The ESnet security team discovered a vulnerability in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the scp support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.

Please note that with the update applied, the '-3' option of scp can no longer be used.

The ESnet security team discovered a vulnerability in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the scp support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.

Please note that with the update applied, the '-3' option of scp can no longer be used.

For Debian 8 'Jessie', this problem has been fixed in version 2.3.4-4+deb8u1.

We recommend that you upgrade your rssh packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
138952	GLSA-202007-29 : rssh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
132323	Amazon Linux AMI : rssh (ALAS-2019-1328)	Nessus	Amazon Linux Local Security Checks	critical
130801	Fedora 31 : rssh (2019-e47add6b2b)	Nessus	Fedora Local Security Checks	critical
130796	Fedora 30 : rssh (2019-d1487c13ac)	Nessus	Fedora Local Security Checks	critical
130794	Fedora 29 : rssh (2019-bfb407659e)	Nessus	Fedora Local Security Checks	critical
124019	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : rssh vulnerabilities (USN-3946-1)	Nessus	Ubuntu Local Security Checks	critical
122658	FreeBSD : rssh - multiple vulnerabilities (d193aa9f-3f8c-11e9-9a24-6805ca0b38e8)	Nessus	FreeBSD Local Security Checks	critical
121485	Debian DSA-4377-1 : rssh - security update	Nessus	Debian Local Security Checks	high
121482	Debian DLA-1650-1 : rssh security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-1000018

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

high