Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0273.3
rssh security update
25 February 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rssh
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-1000018
Reference: ESB-2019.0270
Original Bulletin:
http://www.debian.org/security/2019/dsa-4377
Revision History: February 25 2019: Updated with information from DSA-4377-3
February 12 2019: Updated packages to resolve regression bug
introduced in 4377-1
January 31 2019: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4377-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
January 30, 2019 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : rssh
CVE ID : CVE-2019-1000018
Debian Bug : 919623
The ESnet security team discovered a vulnerability in rssh, a restricted
shell that allows users to perform only scp, sftp, cvs, svnserve
(Subversion), rdist and/or rsync operations. Missing validation in the
scp support could result in the bypass of this restriction, allowing the
execution of arbitrary shell commands.
Please note that with the update applied, the "-3" option of scp can no
longer be used.
For the stable distribution (stretch), this problem has been fixed in
version 2.3.4-5+deb9u1.
We recommend that you upgrade your rssh packages.
For the detailed security status of rssh please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/rssh
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
- -------------------------------------------------------------------------------
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4377-2 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
February 11, 2019 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : rssh
Debian Bug : 921655
The update for rssh issued as DSA 4377-1 introduced a regression that
blocked scp of multiple files from a server using rssh. Updated packages
are now available to correct this issue.
For the stable distribution (stretch), this problem has been fixed in
version 2.3.4-5+deb9u3.
We recommend that you upgrade your rssh packages.
For the detailed security status of rssh please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/rssh
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
- -------------------------------------------------------------------------------
- - - -------------------------------------------------------------------------
Debian Security Advisory DSA-4377-3 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
February 22, 2019 https://www.debian.org/security/faq
- - - -------------------------------------------------------------------------
Package : rssh
CVE ID : CVE-2019-1000018
Debian Bug : 919623
The restrictions introduced in the security fix to address
CVE-2019-1000018 also disallowed the -pf and -pt options which are used
by the scp support in libssh2. This update restores support for those.
For the stable distribution (stretch), this problem has been fixed in
version 2.3.4-5+deb9u4.
We recommend that you upgrade your rssh packages.
For the detailed security status of rssh please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/rssh
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXHNNNWaOgq3Tt24GAQgEJhAAmY90BNkFhOCPCBLYg9c4I9H6ZBU8PgzS
nZbr8UdQV20C0cJ/NpqOkJMGewYZ+zKvsSYm6sEwsGbnHSxAC3ilXxBB3S4BZ40o
ql3cS8sgBBITIFja+VXdkR5XzYjyXijXDUHpVQeVtlKB8GH/8xRtYnFBwbb/3Ro7
kH7Yj2M1XZnj6Ff9GQcMpabcABh+LBokAY6civl9G0y8g1gXyhxapPJS8Y1MxO4u
gWpGVOh7iyyleZhJ4EPDtR85/p2Ki0xecivtD4NsV5JI8xZTTAhCoi/MkGjJEi+e
dUrs9yqC8QyzZsNA7bkPL/hLymY9cE/nWpgIfXIFKtZOosrAbMDLGrAbMp9z3rAQ
hG2agUSzn8KDnhIsDL8WOf40sxOizKXTYl3EXqsb/6Se9ScfJ8tcq+omy+fvfn5V
nMM2fgE8YsBivwv+X5VxPMqMC+3r3A+zwj3RDB0POlKzYVHGI/BlQ6IwXivCTdWl
mKt3DgKL7ER9gslsyqaqQ4WbYiWHOaTXAjEXqnE+ag8jbRBCWhDAaI+cBK1w003H
xwBkGKMcY7+UVsVy0GSvKcZEfEu9UoAGQyByP0ePTAURbjlMIMbR1pyGtF3n4zeH
iRzXJeJ6PsBn1Pd5sJbeVKAoDEaqWVBWvInNLprIpSMoRXysZMbavIejeqM/em1n
o4swg//RDOs=
=1sI3
-----END PGP SIGNATURE-----