Unscored severity · published Dec 28, 2005
CVE-2005-4533
Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Scponly · Scponly
2.0; 2.1; 3.0; 3.5; 3.8; 3.9; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4533
Patch
http://secunia.com/advisories/18223
secunia.com
http://secunia.com/advisories/18236
sublimation.org
http://sublimation.org/scponly/#relnotes
www.gentoo.org
http://www.gentoo.org/security/en/glsa/glsa-200512-17.xml
www.securityfocus.com
http://www.securityfocus.com/bid/16051
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/23875
More from Scponly
–
CVE-2007-6350
scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3)…
–
CVE-2005-4532
scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a…
–
CVE-2004-1162
The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions…
–
CVE-2002-1469
scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading…