PT-2005-1100 · Scponly · Scponly

Pekka Pessi · Publicado 2005-12-28 · Atualizado 2017-10-12 · CVE-2005-4533

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions scponly versions 4.1 and earlier

Description The issue allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered, when both scp and rsync compatibility are enabled. Multiple vulnerabilities in the scponly package can lead to disruption of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For scponly versions 4.1 and earlier, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider disabling the scp and rsync compatibility features until a patch is available. Restrict access to the getopt style argument specifications to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-09494

CVE-2005-4533

DSA-969-1

Produtos afetados

Scponly

Referências · 9

• http://secunia.com/advisories/18223 · Aviso do Fabricante
• http://sublimation.org/scponly/#relnotes · Nota
• http://securityfocus.com/bid/16051 · Nota
• http://security.gentoo.org/glsa/glsa-200512-17.xml · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23875 · Nota
• https://bdu.fstec.ru/vul/2015-09494 · Nota de Segurança
• http://gentoo.org/security/en/glsa/glsa-200512-17.xml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4533 · Nota de Segurança
• http://secunia.com/advisories/18236 · Nota