CVE-2005-4533 Command injection in n/a
Local attackers can execute arbitrary commands via argument injection in scponly when rsync compatibility is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-4533?
CVE-2005-4533 is a high-severity command injection vulnerability in n/a, published on 28 Dec 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered.
Which versions are affected by CVE-2005-4533?
It affects 1 product.
Products include Scponly Scponly.
How do I fix CVE-2005-4533?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2005-4533 being exploited?
There is no known exploitation of CVE-2005-4533 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-ch42-xc83-q8gr.