Ubuntu 18.10: USN-3946-1 Critical Rssh Arbitrary Command Execution

ubuntu

April 11, 2019

rssh could be made to run arbitrary commands if it received specially crafted input.

Summary

rssh could be made to run arbitrary commands if it received specially crafted

input.

Software Description:

- rssh: Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist

Details:

It was discovered that rssh incorrectly handled certain command-line arguments

and environment variables. An authenticated user could bypass rssh's command

restrictions, allowing an attacker to run arbitrary commands.

Topics Covered

security advisory critical rssh ubuntu arbitrary command

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  rssh                            2.3.4-8ubuntu0.2

Ubuntu 18.04 LTS:
  rssh                            2.3.4-7ubuntu0.1

Ubuntu 16.04 LTS:
  rssh                            2.3.4-4+deb8u2ubuntu0.16.04.2

Ubuntu 14.04 LTS:
  rssh                            2.3.4-4+deb8u2ubuntu0.14.04.2

In general, a standard system update will make all the necessary changes.