Vulnerability in rssh - Restricted Shell
Summary
DSA-4377-3: rssh - regression update. Affects rssh versions < 2.3.4-5+deb9u4. Fixed in 2.3.4-5+deb9u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rssh is a restricted shell that provides limited functionality to users, allowing them to perform only scp, sftp, cvs, svnserve, rdist, and rsync operations. It is designed to enhance security by restricting the execution of arbitrary shell commands. However, a vulnerability has been discovered in the scp support of rssh, which could potentially bypass these restrictions and allow the execution of arbitrary shell commands.
Vulnerability Detail
The vulnerability in rssh arises from missing validation in the scp support. This flaw can be exploited to bypass the intended restrictions and execute arbitrary shell commands. Attackers could potentially gain unauthorized access, escalate privileges, or perform malicious actions on the system. It is important to note that the -3 option of scp can no longer be used after applying the update.
How To Fix
Minimum fixed version
2.3.4-5+deb9u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in rssh allows for the bypass of restrictions and execution of arbitrary shell commands. To mitigate this risk, it is crucial to upgrade the rssh package to version 2.3.4-5+deb9u1 or later. This update includes the necessary validation to prevent the exploitation of the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for rssh →
FAQ
rssh is a restricted shell that limits user actions to scp, sftp, cvs, svnserve, rdist, and rsync operations. It is commonly used to enhance security by restricting the execution of arbitrary shell commands.
The vulnerability allows attackers to bypass the intended restrictions of rssh and execute arbitrary shell commands. This can lead to unauthorized access, privilege escalation, and potential malicious actions on the system.
To fix this vulnerability, you should upgrade the rssh package to version 2.3.4-5+deb9u1 or later. This update includes the necessary validation to prevent the bypass of restrictions in the scp support.
No, the -3 option of scp can no longer be used after applying the update. This is to ensure that the vulnerability is fully patched and the system remains secure.
For more detailed security information about rssh, you can refer to its security tracker page at: https://security-tracker.debian.org/tracker/rssh
Related vulnerabilities
Recent vulnerabilities recorded for rssh.
