Multiple vulnerabilities in scponly allow authenticated users to bypass security restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/scponly | * | < 4.8 | >= 4.8 |
scponly is a shell for restricting user access to file transfer only using sftp and scp.
Joachim Breitner reported that Subversion and rsync support invokes subcommands in an insecure manner (CVE-2007-6350). It has also been discovered that scponly does not filter the -o and -F options to the scp executable (CVE-2007-6415).
A local attacker could exploit these vulnerabilities to elevate privileges and execute arbitrary commands on the vulnerable host.
There is no known workaround at this time.
All scponly users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/scponly-4.8"
Due to the design of scponly's Subversion support, security restrictions can still be circumvented. Please read carefully the SECURITY file included in the package.
Local users can exploit an scponly flaw to gain root privileges, and scponly restricted users can use another vulnerability to evade shell restrictions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/scponly | * | < 4.2 | >= 4.2 |
scponly is a restricted shell, allowing only a few predefined commands. It is often used as a complement to OpenSSH to provide access to remote users without providing any remote execution privileges.
Max Vozeler discovered that the scponlyc command allows users to chroot into arbitrary directories. Furthermore, Pekka Pessi reported that scponly insufficiently validates command-line parameters to a scp or rsync command.
A local attacker could gain root privileges by chrooting into arbitrary directories containing hardlinks to setuid programs. A remote scponly user could also send malicious parameters to a scp or rsync command that would allow to escape the shell restrictions and execute arbitrary programs.
There is no known workaround at this time.
All scponly users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/scponly-4.2"
rssh and scponly do not filter command-line options that can be exploited to execute any command, thereby allowing a remote user to completely bypass the restricted shell.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-shells/rssh | * | <= 2.2.2 | >= 2.2.3 |
| net-misc/scponly | * | < 4.0 | >= 4.0 |
rssh and scponly are two restricted shells, allowing only a few predefined commands. They are often used as a complement to OpenSSH to provide access to remote users without providing any remote execution privileges.
Jason Wies discovered that when receiving an authorized command from an authorized user, rssh and scponly do not filter command-line options that can be used to execute any command on the target host.
Using a malicious command, it is possible for a remote authenticated user to execute any command (or upload and execute any file) on the target machine with user rights, effectively bypassing any restriction of scponly or rssh.
There is no known workaround at this time.
All scponly users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/scponly-4.0"
All rssh users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/rssh/rssh-2.2.3"