oss-security - CVE Request: rssh command-line parsing vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <87628q1nak.fsf@windlord.stanford.edu>
Date: Fri, 10 Aug 2012 13:53:39 -0700
From: Russ Allbery <rra@...nford.edu>
To: oss-security@...ts.openwall.com
Subject: CVE Request: rssh command-line parsing vulnerability

Hello all,

I'm the Debian maintainer of the rssh package, which has a security
vulnerability in its command-line parsing disclosed some time back on the
rssh mailing list and on BUGTRAQ.  I'm preparing a security update for
Debian and would like a CVE for tracking purposes.

The security advisory from the upstream maintainer is at:
http://sourceforge.net/mailarchive/message.php?msg_id=29235647

Here are the relevant contents:

| rssh is a shell for restricting SSH access to a machine to only scp,
| sftp, or a small set of similar applications.  
| 
|   http://www.pizzashack.org/rssh/
| 
| Henrik Erkkonen has discovered that, through clever manipulation of
| environment variables on the ssh command line, it is possible to
| circumvent rssh.  As far as I can tell, there is no way to effect a
| root compromise, except of course if the root account is the one
| you're attempting to protect with rssh...
| 
[...]
| 
| Note in particular that ensuring that the AcceptEnv sshd configuration
| option need not be turned on for this exploit to work.

I think this would fit the definition of "local privilege escalation" in
that it allows users with a restricted shell to run commands they
shouldn't be able to run.

The last two messages on the thread linked above contain a patch.  (Be
aware that they've been mangled by the Sourceforge mailing list archive,
so you have to download them to see them.)  There has been no subsequent
formal release, just the patch in that thread.

-- 
Russ Allbery (rra@...nford.edu)             <http://www.eyrie.org/~eagle/>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.