The ESnet security team discovered a vulnerability in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the scp support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.

Please note that with the update applied, the '-3' option of scp can no longer be used.

It was discovered that rssh incorrectly handled certain command-line arguments and environment variables. An authenticated user could bypass rssh's command restrictions, allowing an attacker to run arbitrary commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2019-3463, CVE-2019-3464 and CVE-2019-1000018.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Insufficient sanitation of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3464)

Insufficient sanitation of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. (CVE-2019-3463)

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in 'allowscp' permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the 'allowscp' permission. (CVE-2019-1000018)

NVD reports :

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution.
This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

The ESnet security team discovered a vulnerability in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the scp support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.

Please note that with the update applied, the '-3' option of scp can no longer be used.

For Debian 8 'Jessie', this problem has been fixed in version 2.3.4-4+deb8u1.

We recommend that you upgrade your rssh packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-29 (rssh: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in rssh. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
121485	Debian DSA-4377-1 : rssh - security update	Nessus	Debian Local Security Checks	1/31/2019	6/25/2024	high
124019	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : rssh vulnerabilities (USN-3946-1)	Nessus	Ubuntu Local Security Checks	4/12/2019	10/21/2023	critical
130796	Fedora 30 : rssh (2019-d1487c13ac)	Nessus	Fedora Local Security Checks	11/12/2019	4/12/2024	critical
130794	Fedora 29 : rssh (2019-bfb407659e)	Nessus	Fedora Local Security Checks	11/12/2019	4/12/2024	critical
132323	Amazon Linux AMI : rssh (ALAS-2019-1328)	Nessus	Amazon Linux Local Security Checks	12/20/2019	4/2/2024	critical
122658	FreeBSD : rssh - multiple vulnerabilities (d193aa9f-3f8c-11e9-9a24-6805ca0b38e8)	Nessus	FreeBSD Local Security Checks	3/7/2019	6/17/2024	critical
121482	Debian DLA-1650-1 : rssh security update	Nessus	Debian Local Security Checks	1/31/2019	6/25/2024	high
130801	Fedora 31 : rssh (2019-e47add6b2b)	Nessus	Fedora Local Security Checks	11/12/2019	4/12/2024	critical
138952	GLSA-202007-29 : rssh: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	7/27/2020	2/28/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical

critical

high

critical

critical