high7.5Public exploit code
CVE-2002-1469
scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access c…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SCPOnly 2.3/2.4 - SSH Environment Shell Escaping2002-08-20 · local · linux · Verified
Impact
scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading malicious programs and modifying the PATH variable in $HOME/.ssh/environment to locate those programs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Scponly | Scponly | Versions 2.3, 2.4 |
References
- NVD record
- CVE.org record
- http://online.securityfocus.com/archive/1/288245
- http://www.iss.net/security_center/static/9913.php
- http://www.securityfocus.com/bid/5526
- http://www.sublimation.org/scponly/
- http://online.securityfocus.com/archive/1/288245
- http://www.iss.net/security_center/static/9913.php
- http://www.securityfocus.com/bid/5526
- http://www.sublimation.org/scponly/