From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 1294 invoked from network); 27 Oct 2004 15:13:41 +0000 Received: from smtp.gentoo.org (156.56.111.197) by lists.gentoo.org with AES256-SHA encrypted SMTP; 27 Oct 2004 15:13:41 +0000 Received: from lists.gentoo.org ([156.56.111.196] helo=parrot.gentoo.org) by smtp.gentoo.org with esmtp (Exim 4.41) id 1CMpUb-0003n8-Be for arch-gentoo-announce@lists.gentoo.org; Wed, 27 Oct 2004 15:13:41 +0000 Received: (qmail 2124 invoked by uid 89); 27 Oct 2004 15:12:26 +0000 Mailing-List: contact gentoo-announce-help@lists.gentoo.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org Received: (qmail 18687 invoked from network); 27 Oct 2004 15:02:24 +0000 Message-ID: <417FB871.6090300@gentoo.org> Date: Wed, 27 Oct 2004 17:02:09 +0200 From: Thierry Carrez Organization: Gentoo Linux User-Agent: Mozilla Thunderbird 0.8 (X11/20040918) X-Accept-Language: en-us, en MIME-Version: 1.0 To: gentoo-announce@lists.gentoo.org CC: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, security-alerts@linuxsecurity.com X-Enigmail-Version: 0.86.1.0 X-Enigmail-Supports: pgp-inline, pgp-mime Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enigB590D82436FCCA195CC479BD" X-SCORT-MailScanner: Found to be clean X-SCORT-MailScanner-SpamCheck: not spam, SpamAssassin (score=-4.9, required 5, autolearn=not spam, BAYES_00 -4.90) Subject: [gentoo-announce] [ GLSA 200410-28 ] rssh: Format string vulnerability X-Archives-Salt: 1b0a4b76-9b37-4d05-a9b4-331f4f86cf3d X-Archives-Hash: 698120146e7a5d1e6d10f9850bb87126 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigB590D82436FCCA195CC479BD Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200410-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: rssh: Format string vulnerability Date: October 27, 2004 Bugs: #66988 ID: 200410-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== rssh is vulnerable to a format string vulnerability that allows arbitrary execution of code with the rights of the connected user, thereby bypassing rssh restrictions. Background ========== rssh is a restricted shell, allowing only a few commands like scp or sftp. It is often used as a complement to OpenSSH to provide limited access to users. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-shells/rssh < 2.2.2 >= 2.2.2 Description =========== Florian Schilhabel from the Gentoo Linux Security Audit Team found a format string vulnerability in rssh syslogging of failed commands. Impact ====== Using a malicious command, it may be possible for a remote authenticated user to execute arbitrary code on the target machine with user rights, effectively bypassing any restriction of rssh. Workaround ========== There is no known workaround at this time. Resolution ========== All rssh users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/rssh-2.2.2" References ========== [ 1 ] rssh security announcement http://www.pizzashack.org/rssh/security.shtml Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200410-28.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/1.0 --------------enigB590D82436FCCA195CC479BD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBf7h3vcL1obalX08RAvf7AJ0b0CK99nRGgc62xlEnZAh2q4aQ9QCdHbFT /LiyR9yqeWqxIep1FWWS9ls= =FcW8 -----END PGP SIGNATURE----- --------------enigB590D82436FCCA195CC479BD--