Argument injection vulnerability
Argument injection vulnerability in
scponly 4.6 and earlier allows remote authenticated users to modify
commands when scponly invokes (1) unison, (2) rsync, (3) svn, and (4)
svnserve, which can be leveraged to execute arbitrary code, as
demonstrated by the --diff3-cmd option to svn, a different
vulnerability than CVE-2007-6350.
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6415
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437148
http://secunia.com/advisories/28538
Reply to: