CVE-2007-6415 - scponly allows remote command execution

[Michael Casadevall]

Binary package hint: scponly

scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp, as implemented by OpenSSH, with the -F and -o options.

Fixed in hardy, and intrepid.
Fixes coming for gutsy, fiesty, and dapper

[Michael Casadevall (mcasadevall)]

scponly was fixed by Debian upstream before gutsy release; relevant changelog:

scponly (4.6-1.1) unstable; urgency=high

  * Non-maintainer upload by the testing-security team
  * Disable unison, rsync and svn usability, because all three could be
    exploited. (Closes: #437148)
   - The maintainer is working on splitting the packages and providing
     a binary package, which enables these features, but warns about
     them and one, which is safe and has them disabled, like this

 -- Steffen Joeris <email address hidden> Tue, 25 Sep 2007 10:06:31 +0000

[Michael Casadevall (mcasadevall)]

Attached patch for feisty

[Michael Casadevall (mcasadevall)]

Dapper patch.

[Michael Casadevall (mcasadevall)]

http://bugs.gentoo.org/show_bug.cgi?id=203099 - THis was the patch used to close the security hole

[Jamie Strandboge (jdstrand)]

Actually, guty is affected-- the aforementioned changelog entry is for CVE-2007-6350. CVE-2007-6415 was fixed in Debian in 4.6-1.2.

scponly (4.6-1.2) unstable; urgency=high

  * Non-maintainer upload by the Security Team
  * scp: -o and -F options are dangerous (CVE-2007-6415).

[Jamie Strandboge (jdstrand)]

Thanks Michael for looking submitting the debdiffs and sorry for the delay in processing them. I have reviewed them and came across:
http://www.debian.org/security/2008/dsa-1473
https://bugzilla.redhat.com/show_bug.cgi?id=426072

It looks like you applied only part of the patch. Can you confirm? Also, your changelogs mention adding dpatch and the dpatch file, but this is not in the debdiff. Currently Ubuntu does not add patch systems in security uploads, so please just patch in place since scponly does not have one in place. When you have updated and submitted your debdiffs, please mark back as 'In Progress'.

Thanks again!

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

[Jamie Strandboge (jdstrand)]

scponly (4.6-1etch1build0.6.06.1) dapper-security; urgency=low

  * fake sync from Debian

scponly (4.6-1etch1) stable-security; urgency=high

  * Non-maintainer upload by the Security Team
  * Remove rsync, Subversion and Unison support because it was possible
    to gain shell access through them (CVE-2007-6350). Closes: #437148.
  * scp: -o and -F options are dangerous (CVE-2007-6415).

 -- Jamie Strandboge < <email address hidden>> Wed, 07 Oct 2009 07:47:50 -0500