CVE-2014-2532 – openssh: AcceptEnv environment restriction bypass flaw

https://notcve.org/view.php?id=CVE-2014-2532

sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. sshd en OpenSSH anterior a 6.6 no soporta debidamente comodines en líneas AcceptEnv en sshd_config, lo que permite a atacantes remotos evadir restricciones de entorno mediante el uso de una subcadena localizada antes de un caracter de comodín. It was found that OpenSSH did not properly handle certain AcceptEnv parameter values with wildcard characters. A remote attacker could use this flaw to bypass intended environment variable restrictions. • http://advisories.mageia.org/MGASA-2014-0143.html http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html http://marc.info/?l=bugtraq&m=141576985122836&w=2 http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2 http://rhn.redhat.com& • CWE-138: Improper Neutralization of Special Elements CWE-264: Permissions, Privileges, and Access Controls •