CVE-2006-1320 - util.c in rssh 2.3.0 in Debian GNU/Linux does not use braces to make a block, which causes a check f

CVE-2006-1320

Summary

util.c in rssh 2.3.0 in Debian GNU/Linux does not use braces to make a block, which causes a check for CVS to always succeed and allows rsync and rdist to bypass intended access restrictions in rssh.conf.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346322
http://secunia.com/advisories/21087
http://www.debian.org/security/2006/dsa-1109
http://www.securityfocus.com/bid/18999
https://exchange.xforce.ibmcloud.com/vulnerabilities/25424

Vulnerable Configurations

cpe:2.3:a:rssh:rssh:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:rssh:rssh:2.3.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 20-07-2017 - 01:30)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	18999
confirm	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=346322
debian	DSA-1109
secunia	21087
xf	debian-rssh-rsync-rdist-bypass-security(25424)

Last major update

20-07-2017 - 01:30

Published

20-03-2006 - 11:02

Last modified

20-07-2017 - 01:30