Vulnerabilities > CVE-2005-4532 - Unspecified vulnerability in Scponly

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
scponly
nessus
NVD
Published: 2005-12-28
Updated: 2024-11-21

Summary

scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to modify expected function calls in the setuid application.

Vulnerable Configurations

Part Description Count
Application
Scponly
11

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-969.NASL
    descriptionMax Vozeler discovered a vulnerability in scponly, a utility to restrict user commands to scp and sftp, that could lead to the execution of arbitrary commands as root. The system is only vulnerable if the program scponlyc is installed setuid root and if regular users have shell access to the machine.
    last seen2020-06-01
    modified2020-06-02
    plugin id22835
    published2006-10-14
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/22835
    titleDebian DSA-969-1 : scponly - design error
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200512-17.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200512-17 (scponly: Multiple privilege escalation issues) Max Vozeler discovered that the scponlyc command allows users to chroot into arbitrary directories. Furthermore, Pekka Pessi reported that scponly insufficiently validates command-line parameters to a scp or rsync command. Impact : A local attacker could gain root privileges by chrooting into arbitrary directories containing hardlinks to setuid programs. A remote scponly user could also send malicious parameters to a scp or rsync command that would allow to escape the shell restrictions and execute arbitrary programs. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id20358
    published2005-12-30
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20358
    titleGLSA-200512-17 : scponly: Multiple privilege escalation issues

References