SB2013112801 - Gentoo update for rssh

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2012-2252)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option. Per: http://cwe.mitre.org/data/definitions/184.html 'CWE-184: Incomplete Blacklist'

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-3478)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/201311-19