bugtraq - Security flaw in rssh

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040619074141.GG13649@sophic.org>
Date: Sat, 19 Jun 2004 16:41:41 +0900
From: Derek Martin <code@...zashack.org>
To: secureshell@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Security flaw in rssh

rssh is a small shell whose purpose is to restrict users to using scp
or sftp, and also provides the facilities to place users in a chroot
jail.  It can also be used to lock users out of a system completely.
William F. McCaw identified a minor security flaw in rssh when used
with chroot jails.

There is a bug in rssh 2.0 - 2.1.x which allows a user to gather
information outside of a chrooted jail unintentionally.  The latest
release of rssh fixes this problem, and also improves support for
some non-openssh sftp clients.  Additionally, it extends rssh by
allowing cvs, rsync, and rdist.

The cause of the problem identified by Mr. McCaw is that rssh expanded
command-line arguments prior to entering the chroot jail.  This bug
DOES NOT allow a user to access any of the files outside the jail, but
can allow them to discover what files are in a directory which is
outside the jail, if their credentials on the server would normally
allow them read/execute access in the specified directory.

For example (from William's bug report), if a user has an account on a
server machine which restricts them into a jail using rssh, the
user can use the following command to access the server and see what
files exist in the /etc directory:

  scp target:/etc/* .

The results of this command will look something like this:

  scp: /etc/DIR_COLORS: No such file or directory
  scp: /etc/HOSTNAME: No such file or directory
  scp: /etc/X11: No such file or directory
  scp: /etc/adjtime: No such file or directory
  [ ... ]
  ld.so.cache                                  100%  675     0.0KB/s 00:00
  ld.so.conf                                   100%    0     0.0KB/s 00:00
  [ ... ]
  passwd                                       100%   51     0.0KB/s 00:00
  [ ... ]
  scp: /etc/termcap-Linux: No such file or directory
  scp: /etc/updatedb.conf: No such file or directory
  scp: /etc/warnquota.conf-sample: No such file or directory
  scp: /etc/xml: No such file or directory

The files which succeed in copying exist inside the chroot jail, and
thus should be harmless.  All of the files which produce an error
message exist in the system's /etc directory, but do not exist inside
the chroot jail.  The user is placed in the jail before access to any
of these files is attempted, so again, it is not possible to access
them.  For many sites, this is not a serious issue.  However if it is
important at your site that users not be able to know about any files
which exist outside the chroot jail, then you should upgrade as soon
as possible.

The 2.2.0 release of rssh fixed the problem in question, but was
mistakenly released missing some code for parsing per-user options.  
The 2.2.1 release corrects that problem, and should be the final
release of rssh.  No further development is planned.

You can get the latest release of rssh here:

  http://www.pizzashack.org/rssh/

Thanks for using rssh!

-- 
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D

Content of type "application/pgp-signature" skipped