SB2023020304 - Slackware Linux update for openssh

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023020304

SB2023020304 - Slackware Linux update for openssh

Published: February 3, 2023 Updated: July 26, 2024

Security Bulletin ID SB2023020304
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Security features bypass (CVE-ID: N/A)

CWE-ID: CWE-254 - Security Features

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to a logic error when parsing the PermitRemoteOpen option. The PermitRemoteOpen option would ignore its first argument unless it was one of the special keywords "any" or "none", causing the permission list to fail open if only one permission was specified.


2) Double Free (CVE-ID: CVE-2023-25136)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber


The vulnerability allows a remote attacker to potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the sshd(8) daemon. A remote non-authenticated attacker can send  specially crafted data to the application, trigger a double free error and execute arbitrary code on the target system.

The vendor believes exploitation of this vulnerability has limitations as double free occurs "in the unprivileged pre-auth process that is subject to chroot(2) and is further sandboxed on most major platforms". Nevertheless we assign a high risk to this vulnerability.


Remediation

Install update from vendor's website.

References