| Package: | openssh |
| Date: | 2008-04-25 |
| Vulnerable version: | 4.7p1-4kalgan1 |
| Unaffected version: | 4.7p1-4kalgan2 |
| Bug tracker entry: | http://bugs.frugalware.org/task/2961 |
| CVEs: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1657 |
| Description: | A weakness has been reported in OpenSSH, which can be exploited by malicious, local users to bypass certain security restrictions. The weakness is caused due to the improper implementation of the "ForceCommand" directive. This can be exploited to execute arbitrary commands via the ~/.ssh/rc file even if a "ForceCommand" directive is in effect. |
