PT-2012-1172 · Rssh+1 · Rssh+1

Derek D. Martin · Published 2012-08-31 · Updated 2016-07-01 · CVE-2012-3478

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rssh versions 2.3.3 and earlier

Description The issue allows local users to bypass intended restricted shell access. This can be achieved via crafted environment variables in the command line. Multiple vulnerabilities in the rssh package can lead to violations of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be performed locally.

Recommendations For versions 2.3.3 and earlier, update to version 2.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of environment variables in the command line until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2016-1705

BDU:2015-09711

CVE-2012-3478

DSA-2530-1

Affected Products

Alt Linux

Rssh

References · 17

• https://bdu.fstec.ru/vul/2015-02798 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2252 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1705 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09711 · Security Note
• http://debian.org/security/2012/dsa-2530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3478 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3478 · Security Note
• http://secunia.com/advisories/50272 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html · Note
• http://openwall.com/lists/oss-security/2012/08/10/7 · Note
• http://securityfocus.com/bid/53430 · Note
• http://sourceforge.net/mailarchive/message.php?msg_id=29235647 · Note
• http://security.gentoo.org/glsa/glsa-201311-19.xml · Note
• https://packages.altlinux.org/ru/vuln/CVE-2012-3478 · Note
• http://openwall.com/lists/oss-security/2012/11/28/3 · Note