CVE-2004-1162: The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could a...

Security readout for executives and security teams

Scponly was meant to give authenticated file-transfer users limited access, not a general shell. Before version 4.0, its unison support could let those users run arbitrary programs, bypassing the intended restriction. Risk is highest on legacy systems still using scponly for restricted remote accounts. Exposure is likely limited to legacy hosts running scponly before 4.0, especially where authenticated remote users are intentionally restricted to scp/sftp-style workflows and unison is available. Prioritize remediation on any externally reachable or partner-accessible legacy file-transfer servers. This is not a broad unauthenticated internet bug, but it undermines a control often used to limit business damage from restricted accounts. Mitigation focus: Upgrade scponly to version 4.0 or later where applicable.; Review vendor or distribution guidance for supported legacy packages.; Disable unison access for restricted accounts if upgrade timing is uncertain..

Prepared

Jun 30, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.