Buffer overflow in openssh (Alpine package)

1) Buffer overflow

EUVDB-ID: #VU2075

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10012

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.

The vulnerability exists in sshd due to a flaw in boundary checks in the shared memory manager that may be skipped by some optimizing compilers. A local user can trigger memory corruption and execute arbitrary code with root privileges. The issue is related to m_zback and m_zlib data structures.

Successful exploitation of this vulnerability may allow a local user to elevate privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

openssh (Alpine package): 6.8_p1-r8

External links

http://git.alpinelinux.org/aports/commit/?id=fc53f0a867675bb56c1838c76fc5d493315e60b3
http://git.alpinelinux.org/aports/commit/?id=d9b200e3dd0b2a723993f2e6d625bdd54e96a041
http://git.alpinelinux.org/aports/commit/?id=adecf80bc8f761eaf58245d98a41801e5b62c3d9
http://git.alpinelinux.org/aports/commit/?id=0b546b415bde5a529ffbc08dd3dc0fe78ba82c26
http://git.alpinelinux.org/aports/commit/?id=fa08f3fc9380fa80827e8384c993a3b7a101089b
http://git.alpinelinux.org/aports/commit/?id=51458f4830c2da47954b397d85858f068261ca21
http://git.alpinelinux.org/aports/commit/?id=8d9a5fa9e94e08a1d10f3adbebb033333acc3789
http://git.alpinelinux.org/aports/commit/?id=9c2376cca71f3342159e374d66950adab7632f80

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.