Rssh
CVE-2012-3478
LOW
Severity by source
AV:L/AC:L/Au:N/C:N/I:P/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:L/AC:L/Au:N/C:N/I:P/A:N
Lifecycle Timeline
1DescriptionCVE.org
rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.
AnalysisAI
rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-264. rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line. Affected products include: Pizzashack Rssh.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restri
Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell t
Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypas
rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass inte
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today