-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0782
                           rssh security update
                              16 August 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           rssh
Publisher:         Debian
Operating System:  Debian GNU/Linux 6
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Unauthorised Access             -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-3478  

Original Bulletin: 
   http://www.debian.org/security/2012/dsa-2530

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running rssh check for an updated version of the software for their
         operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2530-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
August 15, 2012                        http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : rssh
Vulnerability  : shell command injection
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3478

Henrik Erkkonen discovered that rssh, a restricted shell for SSH, does
not properly restrict shell access.

For the stable distribution (squeeze), this problem has been fixed in
version 2.3.2-13squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 2.3.3-5.

We recommend that you upgrade your rssh packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJQK/ikAAoJEL97/wQC1SS+kjAH/1/i17W6fGRfBW9Csg95Sz46
QqKIq+80mZIPcE2kPtVe3USmpcfeeOSCptTnyzBbl6GPT3TN2DRPvwbnLdZDqo7r
BMCqPnMR6cO+y54jII5JvhgdChJKWe7MwOkN5HmPuC8T8OjPGEXo1V8+V5o97qZY
b4iACkFXeWj0HjT6zS2sxlpmXCinrwG8P9JhbnvjJoaeuKuqSO6rzU1zxsq7ZY0S
8AgxvGkDI8q16wSVNBs5fMdg8Gr5TwdHvEEZTBllJA9b/fFM6nk4mr99Oio+Cq3s
Y78dsBMf8kmmOlo6TvhwX31zPgulqHckPaOek5RrCm9vilLTNNJB85hAF3s9MgM=
=B9mz
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUCxEg+4yVqjM2NGpAQLCDQ/7B3yXFCAWUovXedNC19hXKq7OI2V5OvZF
sPw0dFo8anFnclLGjyMyoTZx59tsU7Yet6kjpvLstm9ThkdHwdWwyvS4R7Gdy7Cn
ONf0F1c3mNUxctsRT+H5oVYmPzENulP4kChlTlmqjw7uN8whnwrs1fW6B5TPENsf
TLie8VRi+DaP127a+19kUNurn+nYMk9bIUB9hH9hWVS0OkhEn8eaUKN2ty9val02
+qwUqkRSRK08EvwESK1VQPYtsKzk6uE6DOD/nOCpXeQGoK5Pb7GD5P6o0a/INvTp
l/LHh1551bLUo3RRXrLv73jzmjhUO9Lv+KhVhDBDhmZvVIUPudMuUs+xI4/4tYyF
+7dk76KuJo1lxNiYfIGMLykRoci71I6XE2DKDX0JoAXqzcB2qCe2VFfXSm6p8NxY
onIL2s0M9bIXD2xhBNHDcCjISKRjgyNc+1fgZanJ77MGTKPfm1llLk8HZW7Qxs+z
BNM09eBVRLBv77wiiE+2MgHNfazFcCB/0M046hfq6BesvfJE0cGMd9FbBLc3S99+
t2fL/uYh0JN7Q5finOCNEJCmKefgfcskIMdgIisxD2S7g3iJMfQBWdcfbQ6FnpzP
ckXunkxPNBsrdrUgCW77+bgzdXgPM0rYpPoVtU/dmssJSITQlHcquXKGyK+L/Iuj
uOebrV1JQ6A=
=QIWp
-----END PGP SIGNATURE-----