Executive Summary
| Summary | |
|---|---|
| Title | Sun Alert 102978 Security Vulnerability in the rcp(1) Command May Allow Execution of Unintended Commands |
| Informations | |||
|---|---|---|---|
| Name | SUN-102978 | First vendor Publication | 2007-07-10 |
| Vendor | Sun | Last vendor Modification | 2007-07-10 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.9 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Product: Solaris 9 Operating System, Solaris 10 Operating System, Solaris 8 Operating System A security vulnerability in the way the rcp(1) command invokes helper applications may allow a local unprivileged user (or a remote user in the case of shared filesystems) to create files with specially crafted file names which could lead to the execution of arbitrary commands with the privileges of a local user when that local user executes the rcp(1) command on the specially crafted file names. Note: The scp(1) utility is also affected by this issue which is described in the following documents: CVE-2006-0225 at: http://www.security-database.com/detail.php?cve=CVE-2006-0225 Sun Alert 102961 at: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102961-1 Avoidance: Patch, Workaround State: Resolved First released: 10-Jul-2007 |
Original Source
| Url : http://blogs.sun.com/security/entry/sun_alert_102978_security_vulnerability |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1138 | |||
| Oval ID: | oval:org.mitre.oval:def:1138 | ||
| Title: | Security Vulnerability Relating to scp(1) Command May Allow Attackers to Execute Arbitrary Commands | ||
| Description: | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0225 | Version: | 3 |
| Platform(s): | Sun Solaris 9 Sun Solaris 10 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1772 | |||
| Oval ID: | oval:org.mitre.oval:def:1772 | ||
| Title: | Security Vulnerability in the rcp(1) Command May Allow Execution of Unintended Commands | ||
| Description: | rcp on Sun Solaris 8, 9, and 10 before 20070710 does not properly call certain helper applications, which allows local users to gain privileges by creating files with certain names, possibly containing shell metacharacters or spaces, a similar issue to CVE-2006-0225. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3717 | Version: | 1 |
| Platform(s): | Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9962 | |||
| Oval ID: | oval:org.mitre.oval:def:9962 | ||
| Title: | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. | ||
| Description: | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-0225 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-02-03 | Name : Solaris Update for Kernel 122300-48 File : nvt/gb_solaris_122300_48.nasl |
| 2010-02-03 | Name : Solaris Update for Kernel 122301-48 File : nvt/gb_solaris_122301_48.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-13 | Name : Solaris Update for /usr/bin/ssh 114356-19 File : nvt/gb_solaris_114356_19.nasl |
| 2009-10-13 | Name : Solaris Update for /usr/bin/ssh 114357-18 File : nvt/gb_solaris_114357_18.nasl |
| 2009-10-10 | Name : SLES9: Security update for OpenSSH File : nvt/sles9p5021162.nasl |
| 2009-06-03 | Name : Solaris Update for /usr/bin/ssh 114356-18 File : nvt/gb_solaris_114356_18.nasl |
| 2009-06-03 | Name : Solaris Update for /usr/bin/ssh 114357-17 File : nvt/gb_solaris_114357_17.nasl |
| 2009-06-03 | Name : Solaris Update for rcp 114716-05 File : nvt/gb_solaris_114716_05.nasl |
| 2009-06-03 | Name : Solaris Update for rcp 114717-05 File : nvt/gb_solaris_114717_05.nasl |
| 2009-06-03 | Name : Solaris Update for kernel 120011-14 File : nvt/gb_solaris_120011_14.nasl |
| 2009-06-03 | Name : Solaris Update for kernel 120012-14 File : nvt/gb_solaris_120012_14.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200602-11 (OpenSSH) File : nvt/glsa_200602_11.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-045-06 openssh File : nvt/esoft_slk_ssa_2006_045_06.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 36611 | Solaris rcp File Handling Local Privilege Escalation |
| 22692 | OpenSSH scp Command Line Filename Processing Command Injection OpenSSH contains a flaw that may allow an attacker to execute arbitrary commands. The flaw is due to the way OpenSSH's scp utility handles file names during local-to-local copies. During the file name expansion, the utility does not properly sanitize filenames allowing a crafted file name with shell meta-characters. This can be used to trick a user into executing arbitrary commands under with a different set of (potentially higher) privileges. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2012-08-16 | IAVM : 2012-A-0136 - Multiple Vulnerabilities in Juniper Network Management Products Severity : Category I - VMSKEY : V0033662 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-09-13 | Name : The remote host is affected by multiple vulnerabilities. File : juniper_nsm_2012_1.nasl - Type : ACT_GATHER_INFO |
| 2011-10-04 | Name : The version of SSH running on the remote host has a command injection vulnera... File : openssh_43.nasl - Type : ACT_GATHER_INFO |
| 2011-08-29 | Name : The SSH service running on the remote host has an information disclosure vuln... File : sunssh_plaintext_recovery.nasl - Type : ACT_GATHER_INFO |
| 2007-07-18 | Name : The remote host is missing Sun Security Patch number 114717-05 File : solaris9_x86_114717.nasl - Type : ACT_GATHER_INFO |
| 2007-07-18 | Name : The remote host is missing Sun Security Patch number 114716-05 File : solaris9_114716.nasl - Type : ACT_GATHER_INFO |
| 2007-03-13 | Name : The remote host is missing a Mac OS X update which fixes a security issue. File : macosx_10_4_9.nasl - Type : ACT_GATHER_INFO |
| 2006-09-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0698.nasl - Type : ACT_GATHER_INFO |
| 2006-08-04 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0298.nasl - Type : ACT_GATHER_INFO |
| 2006-07-21 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0298.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0044.nasl - Type : ACT_GATHER_INFO |
| 2006-03-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-255-1.nasl - Type : ACT_GATHER_INFO |
| 2006-03-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0044.nasl - Type : ACT_GATHER_INFO |
| 2006-02-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200602-11.nasl - Type : ACT_GATHER_INFO |
| 2006-02-15 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-045-06.nasl - Type : ACT_GATHER_INFO |
| 2006-02-15 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_008.nasl - Type : ACT_GATHER_INFO |
| 2006-02-10 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-034.nasl - Type : ACT_GATHER_INFO |
| 2006-01-24 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-056.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-06-28 20:10:30 |
|
