PT-2006-2329 · Rssh · Rssh

Russ Allbery · Publicado 2006-03-20 · Atualizado 2017-07-20 · CVE-2006-1320

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rssh version 2.3.0

Description The issue is related to a problem in the util.c file of rssh, where the lack of braces to define a block causes a check to always succeed, allowing rsync and rdist to bypass intended access restrictions defined in rssh.conf.

Recommendations For rssh version 2.3.0, consider modifying the util.c file to properly use braces and define blocks, ensuring that access restrictions in rssh.conf are correctly enforced. As a temporary workaround, restrict access to rsync and rdist until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-1320

DSA-1109

Produtos afetados

Rssh

Referências · 6

• http://debian.org/security/2006/dsa-1109 · Aviso do Fabricante
• http://secunia.com/advisories/21087 · Nota
• http://securityfocus.com/bid/18999 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1320 · Nota de Segurança
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346322 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25424 · Nota