CVE-2007-6350 | BDVDB-2026-28189 Detail
Description#
scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3) svn, and (4) svnserve, as originally demonstrated by creating a Subversion (SVN) repository with malicious hooks, then using svn to trigger execution of those hooks.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.securityfocus.com/bid/26900
- http://www.debian.org/security/2008/dsa-1473
- http://bugs.gentoo.org/show_bug.cgi?id=201726
- http://scponly.cvs.sourceforge.net/scponly/scponly/SECURITY?view=markup
- http://www.vupen.com/english/advisories/2007/4243
- http://security.gentoo.org/glsa/glsa-200802-06.xml
- http://secunia.com/advisories/28123
- http://osvdb.org/44137
- http://www.securitytracker.com/id?1019103
- http://secunia.com/advisories/28944
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00595.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437148
- http://secunia.com/advisories/28538
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00546.html
- http://secunia.com/advisories/28981
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.