CVE-2005-4532: scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local...

Security readout for executives and security teams

This is a local privilege escalation in scponlyc from scponly 4.1 and earlier. A user who already has local access could potentially turn a restricted file-transfer account into root-level code execution on systems that support LD_PRELOAD behavior. It is not described as remotely exploitable or actively exploited in the supplied sources. Exposure is likely limited to systems running scponlyc from scponly 4.1 or earlier, especially where local or restricted SCP/SFTP users exist. Internet exposure alone is not enough; the described attack requires local user capability. Prioritize remediation on legacy servers that still use scponly for restricted file transfer. The business risk is account containment failure: a low-privilege local user could become root. Systems without scponlyc or without local restricted users are less likely to be exposed. Mitigation focus: Inventory systems for scponlyc and scponly 4.1 or earlier.; Check Debian, Gentoo, and scponly release guidance for corrected packages.; Upgrade or remove affected scponlyc deployments where vendor fixes are available..

Prepared

Jun 29, 2026, 15:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.