Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 Aug 2015 23:00:53 -0400 (EDT)
Subject: Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities

Hash: SHA256


>> Attackers who could successfully compromise the pre-authentication
>> process for remote code execution

As far as we know, what this means is that the attacker has the
ability to execute arbitrary code (or, specific unintended pieces of
code) with the uid of the sshd account. During a normal
pre-authentication phase, some code runs with this uid, and other code
runs as root. The phrase "pre-authentication process" is potentially
ambiguous, i.e., it could mean either "the sequence of steps that
occur during the pre-authentication phase" or "the UNIX process that
is intentionally running with the sshd uid."

We don't understand why "for remote code execution" was mentioned. A
case where a local attacker, who has access only to the sshd uid, can
exploit a bug in the monitor component seems completely relevant for
purposes of CVE.

In other words, we think the CVE IDs below apply to two types of
threat models: either there is a security-relevant bug in the code
that runs with the sshd uid, or the attacker happens to have access to
the sshd uid for a reason unrelated to the OpenSSH source code (e.g.,
administrative error). In the former case, there would be a separate
CVE ID for any such bug.

>>  * sshd(8): Portable OpenSSH only: Fixed a privilege separation
>>    weakness related to PAM support. Attackers who could successfully
>>    compromise the pre-authentication process for remote code
>>    execution and who had valid credentials on the host could
>>    impersonate other users.  Reported by Moritz Jodeit.

> The user impersonation issue was fixed by the following commit:


Use CVE-2015-6563.

>>  * sshd(8): Portable OpenSSH only: Fixed a use-after-free bug
>>    related to PAM support that was reachable by attackers who could
>>    compromise the pre-authentication process for remote code
>>    execution. Also reported by Moritz Jodeit.

> While the use-after-free is fixed by this commit:


Use CVE-2015-6564.

>>  * sshd(8): OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-
>>    writable. Local attackers may be able to write arbitrary messages
>>    to logged-in users, including terminal escape sequences.
>>    Reported by Nikolay Edigaryev.

Use CVE-2015-6565.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.