PT-2013-1085 · Rssh+1 · Rssh+1
Tomas Hoger
·
Publicado
2013-01-11
·
Atualizado
2017-08-29
·
CVE-2012-2252
CVSS v2.0
4.4
Média
| Vetor | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
rssh versions prior to 2.3.4
Description
The issue concerns multiple vulnerabilities in the rssh package, which can be exploited locally to compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited by a local attacker. Specifically, there is an incomplete blacklist vulnerability in rssh when the rsync protocol is enabled, allowing local users to bypass restricted shell access via the
--rsh command line option.Recommendations
For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the rsync protocol to minimize the risk of exploitation. Restrict access to the rssh package to minimize the risk of local attackers bypassing intended restricted shell access.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Rssh