what you don't know can hurt you

RSSH 2.3.4 Released

RSSH 2.3.4 Released
Posted Nov 28, 2012
Authored by Derek Martin | Site pizzashack.org

RSSH version 2.3.4 was released to address an environment variable manipulation vulnerability and an improper filtering of the rsync command line.

tags | advisory
advisories | CVE-2012-3478, CVE-2012-2252
MD5 | e08b5984cd65e912b520999b78df2a00

RSSH 2.3.4 Released

Change Mirror Download
All,

Today I released rssh-2.3.4, which fixes an old issue, and a new
issue:

On Tue, May 08, 2012 at 01:14:26PM -0500, Derek Martin wrote:
> rssh is a shell for restricting SSH access to a machine to only scp,
> sftp, or a small set of similar applications.
>
> http://www.pizzashack.org/rssh/
>
> Henrik Erkkonen has discovered that, through clever manipulation of
> environment variables on the ssh command line, it is possible to
> circumvent rssh. As far as I can tell, there is no way to effect a
> root compromise, except of course if the root account is the one
> you're attempting to protect with rssh...

This was CVE-2012-3478, for which I had originally only posted a patch
to the rssh mailing list. It is now fixed in the new release.

The new issue is CVE-2012-2252, which involves improper filtering of
the rsync command line, when rsync support is configured. This may be
somewhat of a non-issue for recent stock rssh installations, as
stock rssh does not support newer rsync binaries which use -e to
specify the rsync protocol; thus if you're using rssh with a recent
istallation, rsync does not work for you anyway, and you therefore
most likely have it disabled by config. Nevertheless, it is a
legitimate security concern if you have rsync enabled in the
configuration. This also is fixed in 2.3.4.

This release also includes some mostly trivial updates for the build
and a bit of minor code clean-up.

For people using rssh packages from Debian, Red Hat, or one of their
derivatives, a third vulnerability was recently discovered, assigned
CVE-2012-2251. This issue exists only in a third-party patch to make
rssh work with newer rsync binaries. Stock rssh *is not vulnerable*
to this issue. However if you are relying on your vendor to package
rssh, this likely affects you.

Lastly, since the vendors are providing their own packages, and I'm no
longer set up to build RPMs, I am no longer providing rssh in RPM
form. Please be sure to update rssh to v2.3.4, either by downloading
and compiling from the website, or by updating your vendor's packages.

http://www.pizzashack.org/rssh/downloads.shtml

Thank you.

--
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    8 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close