scponly scponlyc command could allow elevated privileges
| scponly-scponlyc-privilege-escalation (23874) |  Medium Risk |
Description:
scponly could allow a local attacker to gain elevated privileges, caused by a vulnerability in the scponlyc binary. A local attacker could exploit this vulnerability to chroot into arbitrary directories and possibly gain root privileges on the system.
Platforms Affected:
- Debian, Debian Linux 3.1
- Gentoo, Linux
- Joe Boyle, scponly 4.1 and prior
Remedy:
Upgrade to the latest version of scponly (4.2 or later), available from the scponly Web page. See References.
For Debian GNU/Linux:
Refer to DSA-969-1 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to GLSA 200512-17 for upgrade information. See References.
For other distributions:
Contact your vendor for patch or upgrade information.
Consequences:
Gain Privileges
References:
- scponly homepage, download at http://sublimation.org/scponly/index.html#download.
- scponly homepage, release notes at http://sublimation.org/scponly/index.html#relnotes.
- BID-16051: SCPOnly Multiple Local Vulnerabilities
- CVE-2005-4532: scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to modify expected function calls in the setuid application.
- DSA-969: scponly -- design error
- GLSA-200512-17: scponly: Multiple privilege escalation issues
- SA18223: scponly Privilege Escalation and Security Bypass Vulnerabilities
Reported:
Dec 29, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net