Date: Tue, 11 Aug 2015 20:40:38 +0200 From: Moritz Jodeit <moritz@...efrostsecurity.de> To: oss-security@...ts.openwall.com Subject: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities Hello list, could you please assign two CVE IDs for the following two security issues fixed in OpenSSH 7.0 (directly taken from the release notes ): * sshd(8): Portable OpenSSH only: Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users. Reported by Moritz Jodeit. * sshd(8): Portable OpenSSH only: Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution. Also reported by Moritz Jodeit.  http://www.openssh.com/txt/release-7.0 Thank you, Moritz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ