Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 445166 (CVE-2012-2252) - <app-shells/rssh-2.3.4: Commands Filter Security Bypass Vulnerability (CVE-2012-2252)
Summary: <app-shells/rssh-2.3.4: Commands Filter Security Bypass Vulnerability (CVE-20...
Alias: CVE-2012-2252
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B4 [glsa]
Depends on:
Reported: 2012-11-29 11:23 UTC by Agostino Sarubbo
Modified: 2013-11-28 08:48 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2012-11-29 11:23:09 UTC
From :

A vulnerability has been reported in rssh, which can be exploited by malicious, local users to 
bypass certain security restrictions.

The vulnerability is caused due to an error when validating the "--rsh" command line option and can 
be exploited to bypass the allowed commands filter checks resulting in reduced shell restrictions.

The vulnerability is reported in versions prior to 2.3.4.

Update to version 2.3.4.
Comment 1 Markos Chandras (RETIRED) gentoo-dev 2012-11-29 11:36:44 UTC
The bump is on my TODO list for today
Comment 2 Markos Chandras (RETIRED) gentoo-dev 2012-11-29 19:35:57 UTC
Bumped. Please proceed with the stabilization
Comment 3 Agostino Sarubbo gentoo-dev 2012-11-29 19:39:55 UTC
Arches, please test and mark stable:
Target keywords : "amd64 ppc x86"
Comment 4 Dan Dexter 2012-11-30 06:28:33 UTC
Archtested on x86: Everything OK
- Compiles with all USE-flags.
- Repoman reports no errors.
- Successfully set up a restrictive shell and verified that it worked as I intended it to.
Comment 5 Sergey Popov gentoo-dev 2012-11-30 06:40:45 UTC
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2012-12-02 15:42:58 UTC
ppc stable
Comment 7 Andreas Schürch gentoo-dev 2012-12-03 11:18:31 UTC
x86 done, Thanks Dan Dexter for testing!
Last arch!
Comment 8 Sean Amoss (RETIRED) gentoo-dev Security 2012-12-03 12:03:19 UTC
Thanks, everyone.

GLSA vote: no.
Comment 9 Tim Sammut (RETIRED) gentoo-dev 2012-12-10 18:59:02 UTC
GLSA Vote: no too, closing noglsa.
Comment 10 Sergey Popov gentoo-dev 2013-11-18 13:56:39 UTC
Reopening as it has been added to GLSA draft
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2013-11-28 08:48:43 UTC
This issue was resolved and addressed in
 GLSA 201311-19 at
by GLSA coordinator Sergey Popov (pinkbyte).