Unscored CVE-2004-1162 EUVD-2004-1160GHSA-44fx-h63q-q327

The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users …

Published Dec 10, 2004 · Updated Aug 8, 2024 · Assigned by mitre

Description

The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.

References

GLSA-200412-01 vendor-advisory
20050115 Re: rssh and scponly arbitrary command execution mailing-list
20041202 rssh and scponly arbitrary command execution mailing-list
http://www.sublimation.org/scponly/#relnotes
scponly-commandline-command-execution(18362) vdb-entry
11791 vdb-entry