PT-2006-2329 · Rssh · Rssh

Russ Allbery · Published 2006-03-20 · Updated 2017-07-20 · CVE-2006-1320

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rssh version 2.3.0

Description The issue is related to a problem in the util.c file of rssh, where the lack of braces to define a block causes a check to always succeed, allowing rsync and rdist to bypass intended access restrictions defined in rssh.conf.

Recommendations For rssh version 2.3.0, consider modifying the util.c file to properly use braces and define blocks, ensuring that access restrictions in rssh.conf are correctly enforced. As a temporary workaround, restrict access to rsync and rdist until the issue is resolved.

Fix

Related Identifiers

CVE-2006-1320

DSA-1109

Affected Products

Rssh

References · 6

• http://debian.org/security/2006/dsa-1109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1320 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346322 · Patch
• http://secunia.com/advisories/21087 · Note
• http://securityfocus.com/bid/18999 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25424 · Note