CVE-2007-6350

scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3) svn, and (4) svnserve, as originally demonstrated by creating a Subversion (SVN) repository with malicious hooks, then using svn to trigger execution of those hooks.

Link	Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437148
http://scponly.cvs.sourceforge.net/scponly/scponly/SECURITY?view=markup
http://www.securityfocus.com/bid/26900
http://www.securitytracker.com/id?1019103
http://secunia.com/advisories/28123	Vendor Advisory
http://www.debian.org/security/2008/dsa-1473
http://secunia.com/advisories/28538	Vendor Advisory
http://security.gentoo.org/glsa/glsa-200802-06.xml
http://bugs.gentoo.org/show_bug.cgi?id=201726
http://secunia.com/advisories/28944	Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00595.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00546.html
http://secunia.com/advisories/28981	Vendor Advisory
http://osvdb.org/44137
http://www.vupen.com/english/advisories/2007/4243	Vendor Advisory

Configuration 1

cpe:2.3:a:scponly:scponly:*:*:*:*:*:*:*:* cpe:2.3:a:scponly:scponly:4.3:*:*:*:*:*:*:* cpe:2.3:a:scponly:scponly:4.2:*:*:*:*:*:*:* cpe:2.3:a:scponly:scponly:4.5:*:*:*:*:*:*:* cpe:2.3:a:scponly:scponly:4.4:*:*:*:*:*:*:*

---

Published : 2007-12-14 08:46

Updated : 2011-08-08 04:00

---

NVD link : CVE-2007-6350

Mitre link : CVE-2007-6350

No products.

CWE-264

NVD-CWE-noinfo