CVE-2012-2252
First published: Mon Nov 26 2012(Updated: )
Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pizzashack Rssh | <=2.3.3 | |
| Pizzashack Rssh | =2.0.0 | |
| Pizzashack Rssh | =2.0.1 | |
| Pizzashack Rssh | =2.0.2 | |
| Pizzashack Rssh | =2.0.3 | |
| Pizzashack Rssh | =2.0.4 | |
| Pizzashack Rssh | =2.1.0 | |
| Pizzashack Rssh | =2.1.1 | |
| Pizzashack Rssh | =2.2.1 | |
| Pizzashack Rssh | =2.2.2 | |
| Pizzashack Rssh | =2.2.3 | |
| Pizzashack Rssh | =2.3.0 | |
| Pizzashack Rssh | =2.3.1 | |
| Pizzashack Rssh | =2.3.2 | |
| redhat/rssh | <2.3.4 | 2.3.4 |
| debian/rssh |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html
- http://osvdb.org/87926
- http://secunia.com/advisories/51307
- http://secunia.com/advisories/51343
- http://www.debian.org/security/2012/dsa-2578
- http://www.openwall.com/lists/oss-security/2012/11/27/15
- http://www.openwall.com/lists/oss-security/2012/11/28/2
- http://www.openwall.com/lists/oss-security/2012/11/28/3
- http://www.securityfocus.com/bid/56708
- https://bugzilla.redhat.com/show_bug.cgi?id=880177
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80335
- http://sourceforge.net/mailarchive/message.php?msg_id=30153369
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=653346&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=653346&action=edit
- http://patch-tracker.debian.org/patch/series/view/rssh/2.3.3-6/fixes/rsync-protocol.diff
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=880991
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=880992
- http://xforce.iss.net/xforce/xfdb/80335
- https://security-tracker.debian.org/tracker/CVE-2012-2252
Frequently Asked Questions
What is the severity of CVE-2012-2252?
CVE-2012-2252 is considered a moderate severity vulnerability due to its potential to allow local users to bypass restricted shell access.
How do I fix CVE-2012-2252?
To fix CVE-2012-2252, upgrade to rssh version 2.3.4 or later.
Which versions of rssh are affected by CVE-2012-2252?
CVE-2012-2252 affects rssh versions prior to 2.3.4, including 2.3.3 and earlier.
Can CVE-2012-2252 be exploited remotely?
CVE-2012-2252 cannot be exploited remotely as it requires local user access.
What actions can a user take if they are affected by CVE-2012-2252?
Affected users should immediately update to the latest version of rssh to mitigate the vulnerability.
- collector/security-tracker-debian
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-2252
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- package-manager/redhat
- vendor/pizzashack
- canonical/pizzashack rssh
- version/pizzashack rssh/2.3.3
- version/pizzashack rssh/2.0.0
- version/pizzashack rssh/2.0.1
- version/pizzashack rssh/2.0.2
- version/pizzashack rssh/2.0.3
- version/pizzashack rssh/2.0.4
- version/pizzashack rssh/2.1.0
- version/pizzashack rssh/2.1.1
- version/pizzashack rssh/2.2.1
- version/pizzashack rssh/2.2.2
- version/pizzashack rssh/2.2.3
- version/pizzashack rssh/2.3.0
- version/pizzashack rssh/2.3.1
- version/pizzashack rssh/2.3.2