Privilege escalation in OpenSSH - CVE-2016-10010

Vulnerability identifier: #VU2053

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10010

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.

The vulnerability exists due to an error in sshd in serverloop.c, which may allow a local authenticated user to execute arbitrary code with root privileges via a forwarded Unix-domain socket.

Successful exploitation of this vulnerability may allow a local user to elevate privileges.

OpenSSH
Juniper Junos Space
Arch Linux
SUSE Linux Enterprise Micro
FreeBSD
Junos OS
Slackware Linux
Ubuntu
Fedora
openssh (Alpine package)
openssh
cockpit-bridge-debuginfo
cockpit-bridge
cockpit-ws
cockpit-debugsource
cockpit
cockpit-debuginfo
cockpit-ws-debuginfo
cockpit-dashboard
cockpit-system

Install the latest version of OpenSSH 7.4.

Juniper Junos Space - update to 18.2R1
openssh (Alpine package) - update to 6.8_p1-r9
Junos OS - addressed in versions 12.3X48-D55, 12.3R12-S13, 15.1F6-S12, 15.1X49-D100, 15.1R5-S4, 15.1R6-S1, 15.1R7, 16.1R3-S4, 16.1R4-S3, 16.1R5, 16.2R1-S4, 16.2R2, 17.1R1-S2, 17.1R2, 17.2R1
openssh - update to 7.4p1-1.fc25
cockpit-bridge-debuginfo - update to 195.12-150300.10.6.1
cockpit-bridge - update to 195.12-150300.10.6.1
cockpit-ws - update to 195.12-150300.10.6.1
cockpit-debugsource - update to 195.12-150300.10.6.1
cockpit - update to 195.12-150300.10.6.1
cockpit-debuginfo - update to 195.12-150300.10.6.1
cockpit-ws-debuginfo - update to 195.12-150300.10.6.1
cockpit-dashboard - update to 195.12-150300.10.6.1
cockpit-system - update to 195.12-150300.10.6.1

• Exploit #631 - OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation (March 18, 2020)

• https://www.openssh.com/txt/release-7.4
• http://www.openwall.com/lists/oss-security/2016/12/19/2
• https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce

• Multiple vulnerabilities in OpenSSH
• FreeBSD update for OpenSSH
• Arch Linux update for openssh
• Slackware Linux update for openssh
• Ubuntu update for OpenSSH
• Multiple vulnerabilities in Juniper Junos Space
• Juniper Junos OS update for OpenSSH
• Privilege escalation in openssh (Alpine package)
• SUSE update for cockpit
• Fedora 25 update for openssh