Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-1628: rssh before 2.2.2 lets logged‑in users run code

CVE-2004-1628 · published 22 years ago

Summary

The rssh program versions earlier than 2.2.2 have a problem in the way they handle log entries. If someone can log in, they could cause rssh to run any program they want, putting the server at risk. Update rssh to version 2.2.2 or later, apply any available patches, and limit login access to trusted users.

What to do

Update pizzashack rssh to version 2.2.2 or later.

Affected software

Vendor	Product	Affected versions
pizzashack	rssh	< 2.2.2 `cpe:2.3:a:pizzashack:rssh::::::::`

Original advisory text

Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.

References

http://marc.info/?l=bugtraq&m=109855982425122&w=2 Third Party Advisory
http://secunia.com/advisories/12954 Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-200410-28.xml Third Party Advisory
http://www.pizzashack.org/rssh/ Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17831 VDB Entry

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.0 Critical

Exploitation

5% chance of attack within 30 days

Type

CWE-134Use of Externally-Controlled Format String

Timeline

Published23 Oct 2004

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2004-1628 · NVD

Track software like this

Free during beta