CVE-2012-3478 rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.
LowCVSS 2.1
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pizzashack rssh | <= 2.3.2 | No fix listed |
| pizzashack rssh | = 2.0.0 | No fix listed |
| pizzashack rssh | = 2.0.1 | No fix listed |
| pizzashack rssh | = 2.0.2 | No fix listed |
| pizzashack rssh | = 2.0.3 | No fix listed |
| pizzashack rssh | = 2.0.4 | No fix listed |
| pizzashack rssh | = 2.1.0 | No fix listed |
| pizzashack rssh | = 2.1.1 | No fix listed |
| pizzashack rssh | = 2.2.1 | No fix listed |
| pizzashack rssh | = 2.2.2 | No fix listed |
| pizzashack rssh | = 2.2.3 | No fix listed |
| pizzashack rssh | = 2.3.0 | No fix listed |
| pizzashack rssh | = 2.3.1 | No fix listed |
References
- 20120508 rssh security announcement mailing-list
- 20121127 Re: rssh security announcement mailing-list
- 50272 third-party-advisory vendor-advisory
- [rssh-discuss] 20120508 Re: rssh security announcement mailing-list
- DSA-2530 vendor-advisory
- [oss-security] 20120810 CVE Request: rssh command-line parsing vulnerability mailing-list
- [oss-security] 20120810 Re: CVE Request: rssh command-line parsing vulnerability mailing-list
- [oss-security] 20121127 Re: rssh: incorrect filtering of command line options mailing-list
- 53430 vdb-entry