PT-2005-1100 · Scponly · Scponly

Pekka Pessi · Published 2005-12-28 · Updated 2017-10-12 · CVE-2005-4533

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions scponly versions 4.1 and earlier

Description The issue allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered, when both scp and rsync compatibility are enabled. Multiple vulnerabilities in the scponly package can lead to disruption of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For scponly versions 4.1 and earlier, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider disabling the scp and rsync compatibility features until a patch is available. Restrict access to the getopt style argument specifications to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09494

CVE-2005-4533

DSA-969-1

Affected Products

Scponly

References · 9

• http://secunia.com/advisories/18223 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09494 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200512-17.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4533 · Security Note
• http://sublimation.org/scponly/#relnotes · Note
• http://securityfocus.com/bid/16051 · Note
• http://security.gentoo.org/glsa/glsa-200512-17.xml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23875 · Note
• http://secunia.com/advisories/18236 · Note