ISOMAN

CVE

CVE-2019-1000018

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://seclists.org/fulldisclosure/2021/May/78
  2. https://esnet-security.github.io/vulnerabilities/20190115_rssh
  3. https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-33216%2CCVE-2019-1000018/CommScope%20Ruckus%20IoT%20Controller%201.7.1.0%20Undocumented%20Account.txt
  4. https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html
  5. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
  6. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
  7. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
  8. https://security.gentoo.org/glsa/202007-29
  9. https://usn.ubuntu.com/3946-1/
  10. https://www.debian.org/security/2019/dsa-4377
  11. http://seclists.org/fulldisclosure/2021/May/78
  12. https://esnet-security.github.io/vulnerabilities/20190115_rssh
  13. https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html
  14. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
  15. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
  16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
  17. https://security.gentoo.org/glsa/202007-29
  18. https://usn.ubuntu.com/3946-1/
  19. https://www.debian.org/security/2019/dsa-4377