Bug 426072 (CVE-2007-6415) - CVE-2007-6415 scponly: scp restriction bypass
Summary: CVE-2007-6415 scponly: scp restriction bypass
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-6415
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 429731 429732
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-12-18 08:02 UTC by Tomas Hoger
Modified: 2019-09-29 12:22 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-02-22 14:11:19 UTC


Attachments (Terms of Use)
Patch extracted from Debian packages (980 bytes, patch)
2008-01-22 19:11 UTC, Tomas Hoger
no flags Details | Diff

Description Tomas Hoger 2007-12-18 08:02:17 UTC
Florian Weimer of Debian project has reported, that scponly's support for scp
transfer is prone to similar bypass issues as described for rsync, unison and
svn in CVE-2007-6350.

CVE-2007-6415
| scponly 4.6 and earlier allows remote authenticated users to bypass
| intended restrictions and execute code by invoking scp, as implemented
| by OpenSSH, with the -F and -o options.

Comment 3 Tomas Hoger 2008-01-22 08:31:24 UTC
Public now via Debian security advisory DSA-1473:

http://marc.info/?l=full-disclosure&m=120095469521345&w=4

Comment 4 Tomas Hoger 2008-01-22 08:34:15 UTC
Relevant change seems to be the addition of 'o' and 'F' options to the list of
disallowed options:

--- scponly-4.6.orig/scponly.c
+++ scponly-4.6/scponly.c
@@ -92,7 +92,7 @@
     * program name     use getopt?     strict optlist? optname         optlist
     */
 #ifdef ENABLE_SCP2
-   { PROG_SCP,         1,              1,              "S",           
"dfl:prtvBCc:i:P:q1246S:o:F:" },
+   { PROG_SCP,         1,              1,              "SoF",         
"dfl:prtvBCc:i:P:q1246S:o:F:" },
 #endif
 #ifdef RSYNC_COMPAT
    { PROG_RSYNC,       1,              0,              "e",            "e:" },


Comment 5 Tomas Hoger 2008-01-22 19:11:56 UTC
Created attachment 292548 [details]
Patch extracted from Debian packages

I was wrong in the comment #4, something seems to have been missing.

Btw. upstream version 4.8 is out, even though it is not mentioned on the
scponly wiki download page
(http://sublimation.org/scponly/wiki/index.php/Download).

Comment 7 Tomas Hoger 2008-02-13 20:09:35 UTC
Patch committed and new packages built in rawhide.

For F7 and F8 (and EPEL), some solution for CVE-2007-6350 should be included as
well.  Does disabling of rsync as was done in rawhide make sense to you?

Comment 8 Toshio Ernie Kuratomi 2008-02-13 21:07:37 UTC
Yes, that makes perfect sense to me.  Patch and rsync disabled spec file have
been committed and built for F7, F8, EL-4, EL5.

Comment 9 Fedora Update System 2008-02-13 21:12:05 UTC
scponly-4.6-10.fc8 has been submitted as an update for Fedora 8

Comment 10 Fedora Update System 2008-02-13 21:14:22 UTC
scponly-4.6-10.fc7 has been submitted as an update for Fedora 7

Comment 11 Fedora Update System 2008-02-16 02:09:00 UTC
scponly-4.6-10.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2008-02-16 02:14:40 UTC
scponly-4.6-10.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Red Hat Product Security 2008-02-22 14:11:19 UTC
This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1728
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1743




Note You need to log in before you can comment on or make changes to this bug.