CVE-2012-2251: Input Validation
Published Jan 11, 2013
·Updated
rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option.
Affected Software
4 affected components
debian/rssh
Pizzashack Rssh=2.3.2
Debian Debian Linux
Fedoraproject Fedora
Event History
Jan 11, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2251?
CVE-2012-2251 has a medium severity rating allowing local users to bypass restricted shell access.
2
How do I fix CVE-2012-2251?
To fix CVE-2012-2251, upgrade to a version of rssh that is not affected, specifically above 2.3.2.
3
Who is affected by CVE-2012-2251?
CVE-2012-2251 affects users running rssh version 2.3.2 on Debian, Fedora, and similar systems.
4
What operation allows the bypass in CVE-2012-2251?
The bypass in CVE-2012-2251 occurs when using the "-e" or "--" command line option with enabled rsync protocol.
5
Can remote users exploit CVE-2012-2251?
No, CVE-2012-2251 is a local privilege escalation vulnerability that cannot be exploited remotely.