FKIE_CVE-2012-2252

Vulnerability from fkie_nvd - Published: 2013-01-11 01:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.
References
security@debian.orghttp://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html
security@debian.orghttp://osvdb.org/87926
security@debian.orghttp://secunia.com/advisories/51307Vendor Advisory
security@debian.orghttp://secunia.com/advisories/51343Vendor Advisory
security@debian.orghttp://www.debian.org/security/2012/dsa-2578
security@debian.orghttp://www.openwall.com/lists/oss-security/2012/11/27/15
security@debian.orghttp://www.openwall.com/lists/oss-security/2012/11/28/2
security@debian.orghttp://www.openwall.com/lists/oss-security/2012/11/28/3
security@debian.orghttp://www.securityfocus.com/bid/56708
security@debian.orghttps://bugzilla.redhat.com/show_bug.cgi?id=880177
security@debian.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/80335
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/87926
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51307Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51343Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2012/dsa-2578
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/11/27/15
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/11/28/2
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/11/28/3
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/56708
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=880177
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/80335
Impacted products
Vendor Product Version
pizzashack rssh *
pizzashack rssh 2.0.0
pizzashack rssh 2.0.1
pizzashack rssh 2.0.2
pizzashack rssh 2.0.3
pizzashack rssh 2.0.4
pizzashack rssh 2.1.0
pizzashack rssh 2.1.1
pizzashack rssh 2.2.1
pizzashack rssh 2.2.2
pizzashack rssh 2.2.3
pizzashack rssh 2.3.0
pizzashack rssh 2.3.1
pizzashack rssh 2.3.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "541B5F5E-B34F-4E0C-99A0-99AF53D7536F",
              "versionEndIncluding": "2.3.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "405D117C-7A65-48DD-B898-4E7526A47392",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "02796C4B-F155-4D6B-9692-0C467B259B3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D3BE629-9E24-4E48-9ADD-61174BBAD270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "147D0EA0-3F3E-488E-A5FF-618614B34D9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "994DDFAC-D9D6-4146-8628-5014E52A6847",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA58CBF8-1826-44D7-B2F0-999B8DA61F1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D984CE9-5283-4DAE-9D42-9B5AE31A4002",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D718FA8D-2699-4150-AB39-357E1585EB46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "255C9863-4D7E-46CE-A1C9-F897EFB85D38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "72CB8450-D58D-4824-931F-2D61451F2C5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C75A3EB-ABDF-458B-8B49-505791EF8749",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6BACEEB-9CBD-4E94-A3EF-61E220F2D68E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pizzashack:rssh:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F69D6E8-00A6-417C-A458-F8C4B90CB694",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en rssh antes de v2.3.4, cuando el protocolo rsync est\u00e1 activado, permite a los usuarios locales eludir las restricciones de acceso a la interfaz de comandos a trav\u00e9s de la opci\u00f3n --rsh de la l\u00ednea de comandos.\r\n"
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/184.html \u0027CWE-184: Incomplete Blacklist\u0027",
  "id": "CVE-2012-2252",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-01-11T01:55:00.837",
  "references": [
    {
      "source": "security@debian.org",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html"
    },
    {
      "source": "security@debian.org",
      "url": "http://osvdb.org/87926"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51307"
    },
    {
      "source": "security@debian.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51343"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.debian.org/security/2012/dsa-2578"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.openwall.com/lists/oss-security/2012/11/27/15"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.openwall.com/lists/oss-security/2012/11/28/2"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.openwall.com/lists/oss-security/2012/11/28/3"
    },
    {
      "source": "security@debian.org",
      "url": "http://www.securityfocus.com/bid/56708"
    },
    {
      "source": "security@debian.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=880177"
    },
    {
      "source": "security@debian.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80335"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/87926"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51307"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/51343"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2012/dsa-2578"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/11/27/15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/11/28/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/11/28/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/56708"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=880177"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80335"
    }
  ],
  "sourceIdentifier": "security@debian.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.