Incorrect handling of environment files in OpenSSH - CVE-2015-8325

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU251

Incorrect handling of environment files in OpenSSH - CVE-2015-8325

Published: August 2, 2016 / Updated: August 22, 2016


Vulnerability identifier: #VU251
CSH Severity: Low
CVSS v4: 8.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2015-8325
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists in portable version of OpenSSH. A local user can execute arbitrary code as root by setting specially crafted environment variables to conduct attacks against the 'bin/login' process on systems, where PAM is configured to read user-specified environment variables and 'sshd_config' is set to 'UseLogin=yes'.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.



Affected software

OpenSSH
Amazon Linux AMI
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Junos OS
Slackware Linux
Fedora
openssh (Debian package)
openssh (Ubuntu package)
openssh (Red Hat package)
gsi-openssh
openssh
Dell EMC VxRail Appliance

How to mitigate CVE-2015-8325

Install the latest version of OpenSSH 7.3.

openssh (Debian package) - addressed in versions 1:6.0p1-4+deb7u4, 1:6.7p1-5+deb8u2, 1:7.2p2-3
Junos OS - addressed in versions 12.3X48-D55, 12.3R12-S13, 15.1F6-S12, 15.1X49-D100, 15.1R5-S4, 15.1R6-S1, 15.1R7, 16.1R3-S4, 16.1R4-S3, 16.1R5, 16.2R1-S4, 16.2R2, 17.1R1-S2, 17.1R2, 17.2R1
Dell EMC VxRail Appliance - update to 4.5.450
openssh (Red Hat package) - update to 6.6.1p1-31.el7
gsi-openssh - addressed in versions 7.2p2-2.fc23, 7.2p2-3.fc24
openssh - addressed in versions 7.2p2-3.fc23, 7.2p2-5.fc24

External References

Related Security Bulletins