Description
OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:4.7p1-8 | — |
| Debian 13 | openssh | 1:4.7p1-8 | — |
| Debian 12 | openssh | 1:4.7p1-8 | — |
References
- 28531 vdb-entry
- http://support.attachmate.com/techdocs/2374.html
- USN-649-1 vendor-advisory
- 32110 third-party-advisory
- https://issues.rpath.com/browse/RPL-2419
- APPLE-SA-2008-09-15 vendor-advisory
- 29609 third-party-advisory
- 31531 third-party-advisory
- [4.3] 001: SECURITY FIX: March 30, 2008 vendor-advisory
- http://aix.software.ibm.com/aix/efixes/security/ssh_advisory.asc
- TA08-260A third-party-advisory
- http://www.openssh.com/txt/release-4.9
- 1019733 vdb-entry
- ADV-2008-1624 vdb-entry
- ADV-2008-2584 vdb-entry
- 29735 third-party-advisory
- 29683 third-party-advisory
- 30361 third-party-advisory
- 31882 third-party-advisory
- SUSE-SR:2008:009 vendor-advisory
- 32080 third-party-advisory
- ADV-2008-2396 vdb-entry
- 29939 third-party-advisory
- ADV-2008-1035 vdb-entry
- 29602 third-party-advisory
- 20080404 rPSA-2008-0139-1 gnome-ssh-askpass openssh openssh-client openssh-server mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0139
- 29693 third-party-advisory
- MDVSA-2008:098 vendor-advisory
- GLSA-200804-03 vendor-advisory
- openssh-forcecommand-command-execution(41549) vdb-entry