Florian Weimer of Debian project has reported, that scponly's support for scp transfer is prone to similar bypass issues as described for rsync, unison and svn in CVE-2007-6350. CVE-2007-6415 | scponly 4.6 and earlier allows remote authenticated users to bypass | intended restrictions and execute code by invoking scp, as implemented | by OpenSSH, with the -F and -o options.
Public now via Debian security advisory DSA-1473: http://marc.info/?l=full-disclosure&m=120095469521345&w=4
Relevant change seems to be the addition of 'o' and 'F' options to the list of disallowed options: --- scponly-4.6.orig/scponly.c +++ scponly-4.6/scponly.c @@ -92,7 +92,7 @@ * program name use getopt? strict optlist? optname optlist */ #ifdef ENABLE_SCP2 - { PROG_SCP, 1, 1, "S", "dfl:prtvBCc:i:P:q1246S:o:F:" }, + { PROG_SCP, 1, 1, "SoF", "dfl:prtvBCc:i:P:q1246S:o:F:" }, #endif #ifdef RSYNC_COMPAT { PROG_RSYNC, 1, 0, "e", "e:" },
Created attachment 292548 [details] Patch extracted from Debian packages I was wrong in the comment #4, something seems to have been missing. Btw. upstream version 4.8 is out, even though it is not mentioned on the scponly wiki download page (http://sublimation.org/scponly/wiki/index.php/Download).
Patch committed and new packages built in rawhide. For F7 and F8 (and EPEL), some solution for CVE-2007-6350 should be included as well. Does disabling of rsync as was done in rawhide make sense to you?
Yes, that makes perfect sense to me. Patch and rsync disabled spec file have been committed and built for F7, F8, EL-4, EL5.
scponly-4.6-10.fc8 has been submitted as an update for Fedora 8
scponly-4.6-10.fc7 has been submitted as an update for Fedora 7
scponly-4.6-10.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
scponly-4.6-10.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in: Fedora: https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1728 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1743