Explain CVE-2008-1657
OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
Affected Products: n/a
References: [{'name': '28531', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/28531'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.attachmate.com/techdocs/2374.html'}, {'name': 'USN-649-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-649-1'}, {'name': '32110', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32110'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.rpath.com/browse/RPL-2419'}, {'name': 'APPLE-SA-2008-09-15', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html'}, {'name': '29609', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29609'}, {'name': '31531', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31531'}, {'name': '[4.3] 001: SECURITY FIX: March 30, 2008', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata43.html#001_openssh'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://aix.software.ibm.com/aix/efixes/security/ssh_advisory.asc'}, {'name': 'TA08-260A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA08-260A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openssh.com/txt/release-4.9'}, {'name': '1019733', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1019733'}, {'name': 'ADV-2008-1624', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1624/references'}, {'name': 'ADV-2008-2584', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/2584'}, {'name': '29735', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29735'}, {'name': '29683', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29683'}, {'name': '30361', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/30361'}, {'name': '31882', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31882'}, {'name': 'SUSE-SR:2008:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html'}, {'name': '32080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32080'}, {'name': 'ADV-2008-2396', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/2396'}, {'name': '29939', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29939'}, {'name': 'ADV-2008-1035', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2008/1035/references'}, {'name': '29602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29602'}, {'name': '20080404 rPSA-2008-0139-1 gnome-ssh-askpass openssh openssh-client openssh-server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/490488/100/0/threaded'}, {'name': 'NetBSD-SA2008-005', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0139'}, {'name': '29693', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/29693'}, {'name': 'MDVSA-2008:098', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2008:098'}, {'name': 'GLSA-200804-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200804-03.xml'}, {'name': 'openssh-forcecommand-command-execution(41549)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/41549'}]
CVE State: PUBLISHED