CVEvulnerability
CVE-2007-6350
8.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-12-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 8.5 HIGH — AV:N/AC:M/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3) svn, and (4) svnserve, as originally demonstrated by creating a Subversion (SVN) repository with malicious hooks, then using svn to trigger execution of those hooks.
Affected configurations
• scponly scponly (<= 4.6)
• scponly scponly 4.2
• scponly scponly 4.3
• scponly scponly 4.4
• scponly scponly 4.5
Related
Weakness · not in database (1)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437148 bugs.debian.org
- http://bugs.gentoo.org/show_bug.cgi?id=201726 bugs.gentoo.org
- http://osvdb.org/44137 osvdb.org
- http://scponly.cvs.sourceforge.net/scponly/scponly/SECURITY?view=markup scponly.cvs.sourceforge.net
- http://secunia.com/advisories/28123 Vendor Advisory
- http://secunia.com/advisories/28538 Vendor Advisory
- http://secunia.com/advisories/28944 Vendor Advisory
- http://secunia.com/advisories/28981 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200802-06.xml security.gentoo.org
- http://www.debian.org/security/2008/dsa-1473 www.debian.org
- http://www.securityfocus.com/bid/26900 www.securityfocus.com
- http://www.securitytracker.com/id?1019103 www.securitytracker.com
- http://www.vupen.com/english/advisories/2007/4243 Vendor Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00546.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00595.html www.redhat.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437148 bugs.debian.org
- http://bugs.gentoo.org/show_bug.cgi?id=201726 bugs.gentoo.org
- http://osvdb.org/44137 osvdb.org
- http://scponly.cvs.sourceforge.net/scponly/scponly/SECURITY?view=markup scponly.cvs.sourceforge.net
- http://secunia.com/advisories/28123 Vendor Advisory
- http://secunia.com/advisories/28538 Vendor Advisory
- http://secunia.com/advisories/28944 Vendor Advisory
- http://secunia.com/advisories/28981 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200802-06.xml security.gentoo.org
- http://www.debian.org/security/2008/dsa-1473 www.debian.org
- http://www.securityfocus.com/bid/26900 www.securityfocus.com
- http://www.securitytracker.com/id?1019103 www.securitytracker.com
- http://www.vupen.com/english/advisories/2007/4243 Vendor Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00546.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00595.html www.redhat.com