Unscored severity · published Jan 10, 2005
CVE-2004-1162
The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions…
–
CVSS
1.9%
EPSS
No
On KEV
Description
The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via the (1) -rshcmd or (2) -sshcmd flags.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Gentoo
All versions, or not specified · source: NVD
SC
Scponly · Scponly
2.0; 2.1; 2.3; 2.4; 3.0; 3.5; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1162
marc.info
http://marc.info/?l=bugtraq&m=110202047507273&w=2
marc.info
http://marc.info/?l=bugtraq&m=110581113814623&w=2
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200412-01.xml
Exploit
http://www.securityfocus.com/bid/11791
www.sublimation.org
http://www.sublimation.org/scponly/#relnotes
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/18362
More from Linux
9.8
CVE-2024-12084
Rsync: heap buffer overflow in rsync due to improper checksum length handling
7.5
CVE-2024-12087
Rsync: path traversal vulnerability in rsync
7.5
CVE-2024-12088
Rsync: --safe-links option bypass leads to path traversal
7.5
CVE-2024-12085
Rsync: info leak via uninitialized stack contents
6.8
CVE-2024-12086
A flaw was found in rsync