Bug 426072 - (CVE-2007-6415) CVE-2007-6415 scponly: scp restriction bypass
CVE-2007-6415 scponly: scp restriction bypass
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
source=vendorsec,public=20071215,publ...
: Security
Depends On: 429731 429732
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-18 03:02 EST by Tomas Hoger
Modified: 2008-02-22 09:11 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-02-22 09:11:19 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Patch extracted from Debian packages (980 bytes, patch)
2008-01-22 14:11 EST, Tomas Hoger
no flags Details | Diff

  None (edit)
Description Tomas Hoger 2007-12-18 03:02:17 EST
Florian Weimer of Debian project has reported, that scponly's support for scp
transfer is prone to similar bypass issues as described for rsync, unison and
svn in CVE-2007-6350.

CVE-2007-6415
| scponly 4.6 and earlier allows remote authenticated users to bypass
| intended restrictions and execute code by invoking scp, as implemented
| by OpenSSH, with the -F and -o options.
Comment 3 Tomas Hoger 2008-01-22 03:31:24 EST
Public now via Debian security advisory DSA-1473:

http://marc.info/?l=full-disclosure&m=120095469521345&w=4
Comment 4 Tomas Hoger 2008-01-22 03:34:15 EST
Relevant change seems to be the addition of 'o' and 'F' options to the list of
disallowed options:

--- scponly-4.6.orig/scponly.c
+++ scponly-4.6/scponly.c
@@ -92,7 +92,7 @@
     * program name     use getopt?     strict optlist? optname         optlist
     */
 #ifdef ENABLE_SCP2
-   { PROG_SCP,         1,              1,              "S",           
"dfl:prtvBCc:i:P:q1246S:o:F:" },
+   { PROG_SCP,         1,              1,              "SoF",         
"dfl:prtvBCc:i:P:q1246S:o:F:" },
 #endif
 #ifdef RSYNC_COMPAT
    { PROG_RSYNC,       1,              0,              "e",            "e:" },
Comment 5 Tomas Hoger 2008-01-22 14:11:56 EST
Created attachment 292548 [details]
Patch extracted from Debian packages

I was wrong in the comment #4, something seems to have been missing.

Btw. upstream version 4.8 is out, even though it is not mentioned on the
scponly wiki download page
(http://sublimation.org/scponly/wiki/index.php/Download).
Comment 7 Tomas Hoger 2008-02-13 15:09:35 EST
Patch committed and new packages built in rawhide.

For F7 and F8 (and EPEL), some solution for CVE-2007-6350 should be included as
well.  Does disabling of rsync as was done in rawhide make sense to you?
Comment 8 Toshio Ernie Kuratomi 2008-02-13 16:07:37 EST
Yes, that makes perfect sense to me.  Patch and rsync disabled spec file have
been committed and built for F7, F8, EL-4, EL5.
Comment 9 Fedora Update System 2008-02-13 16:12:05 EST
scponly-4.6-10.fc8 has been submitted as an update for Fedora 8
Comment 10 Fedora Update System 2008-02-13 16:14:22 EST
scponly-4.6-10.fc7 has been submitted as an update for Fedora 7
Comment 11 Fedora Update System 2008-02-15 21:09:00 EST
scponly-4.6-10.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2008-02-15 21:14:40 EST
scponly-4.6-10.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Red Hat Product Security 2008-02-22 09:11:19 EST
This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1728
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1743


Note You need to log in before you can comment on or make changes to this bug.