Bug 426072 (CVE-2007-6415)

Summary: CVE-2007-6415 scponly: scp restriction bypass
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: a.badger, security-response-team, tkuratom, wtogami
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-02-22 14:11:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 429731, 429732    
Bug Blocks:    
Attachments:
Description Flags
Patch extracted from Debian packages none

Description Tomas Hoger 2007-12-18 08:02:17 UTC 
Florian Weimer of Debian project has reported, that scponly's support for scp
transfer is prone to similar bypass issues as described for rsync, unison and
svn in CVE-2007-6350.

CVE-2007-6415
| scponly 4.6 and earlier allows remote authenticated users to bypass
| intended restrictions and execute code by invoking scp, as implemented
| by OpenSSH, with the -F and -o options.
Comment 3 Tomas Hoger 2008-01-22 08:31:24 UTC 
Public now via Debian security advisory DSA-1473:

http://marc.info/?l=full-disclosure&m=120095469521345&w=4
Comment 4 Tomas Hoger 2008-01-22 08:34:15 UTC 
Relevant change seems to be the addition of 'o' and 'F' options to the list of
disallowed options:

--- scponly-4.6.orig/scponly.c
+++ scponly-4.6/scponly.c
@@ -92,7 +92,7 @@
     * program name     use getopt?     strict optlist? optname         optlist
     */
 #ifdef ENABLE_SCP2
-   { PROG_SCP,         1,              1,              "S",           
"dfl:prtvBCc:i:P:q1246S:o:F:" },
+   { PROG_SCP,         1,              1,              "SoF",         
"dfl:prtvBCc:i:P:q1246S:o:F:" },
 #endif
 #ifdef RSYNC_COMPAT
    { PROG_RSYNC,       1,              0,              "e",            "e:" },
Comment 5 Tomas Hoger 2008-01-22 19:11:56 UTC 
Created attachment 292548 [details]
Patch extracted from Debian packages

I was wrong in the comment #4, something seems to have been missing.

Btw. upstream version 4.8 is out, even though it is not mentioned on the
scponly wiki download page
(http://sublimation.org/scponly/wiki/index.php/Download).
Comment 7 Tomas Hoger 2008-02-13 20:09:35 UTC 
Patch committed and new packages built in rawhide.

For F7 and F8 (and EPEL), some solution for CVE-2007-6350 should be included as
well.  Does disabling of rsync as was done in rawhide make sense to you?
Comment 8 Toshio Ernie Kuratomi 2008-02-13 21:07:37 UTC 
Yes, that makes perfect sense to me.  Patch and rsync disabled spec file have
been committed and built for F7, F8, EL-4, EL5.
Comment 9 Fedora Update System 2008-02-13 21:12:05 UTC 
scponly-4.6-10.fc8 has been submitted as an update for Fedora 8
Comment 10 Fedora Update System 2008-02-13 21:14:22 UTC 
scponly-4.6-10.fc7 has been submitted as an update for Fedora 7
Comment 11 Fedora Update System 2008-02-16 02:09:00 UTC 
scponly-4.6-10.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2008-02-16 02:14:40 UTC 
scponly-4.6-10.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Red Hat Product Security 2008-02-22 14:11:19 UTC 
This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1728
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1743