Debian DSA-2578-1 : rssh - insufficient filtering of rsync command line

medium Nessus Plugin ID 63068

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned :

- CVE-2012-2251 Incorrect filtering of command line when using rsync protocol. It was for example possible to pass dangerous options after a '--' switch. The rsync protocol support has been added in a Debian (and Fedora/Red Hat) specific patch, so this vulnerability doesn't affect upstream.

- CVE-2012-2252 Incorrect filtering of the '--rsh' option: the filter preventing usage of the'--rsh=' option would not prevent passing '--rsh'. This vulnerability affects upstream code.

Solution

Upgrade the rssh packages.

For the stable distribution (squeeze), this problem has been fixed in version 2.3.2-13squeeze3.

Plugin Details

Severity: Medium

ID: 63068

File Name: debian_DSA-2578.nasl

Version: 1.11

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 11/28/2012

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:rssh

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 11/28/2012

Reference Information

CVE: CVE-2012-2251, CVE-2012-2252

DSA: 2578

Detections

Analytics