CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2015-6565 – OpenSSH 6.8 < 6.9 - 'PTY' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-6565
sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence. El fichero sshd en OpenSSH 6.8 and 6.9 fija permisos de lectura para cualquier usuario en dispositivos TTY, lo que posibilita a usuarios locales provocar denegación de servicio (desorganización de terminales) o tener un impacto inesperado al escribir sobre un dispositivo, como se demuestra escribiendo una secuencia de escape OpenSSH versions 6.8 and 6.9 suffer from a PTY privilege escalation vulnerability. • https://www.exploit-db.com/exploits/41173 http://openwall.com/lists/oss-security/2017/01/26/2 http://www.openssh.com/txt/release-7.0 http://www.openwall.com/lists/oss-security/2015/08/22/1 http://www.securityfocus.com/bid/76497 http://www.securitytracker.com/id/1033917 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085 https://h20566.www2.hpe.com/portal/site&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6564 – openssh: Use-after-free bug related to PAM support
https://notcve.org/view.php?id=CVE-2015-6564
Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. Vulnerabilidad de uso después de la liberación de la memoria en la función mm_answer_pam_free_ctx en monitor.c en sshd en OpenSSH en versiones anteriores a 7.0 en plataformas no OpenBSD, podría permitir a usuarios locales obtener privilegios mediante el aprovechamiento del control del sshd uid para enviar una petición MONITOR_REQ_PAM_FREE_CTX inesperadamente temprana. A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html http://rhn.redhat.com/errata/RHSA-2016-0741.html http://seclists.org/fulldisclosure/2015/Aug/54 http://www.openssh.com/txt/release-7.0 http://www.openwall.com/lists/oss-security/2015/08/22/1 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr20 • CWE-264: Permissions, Privileges, and Access Controls CWE-416: Use After Free •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2015-6563 – openssh: Privilege separation weakness related to PAM support
https://notcve.org/view.php?id=CVE-2015-6563
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. Vulnerabilidad en el componente monitor en sshd en OpenSSH en versiones anteriores a 7.0 en plataformas no OpenBSD, acepta datos de nombre de usuario extraños en las solicitudes MONITOR_REQ_PAM_INIT_CTX, lo que permite a usuarios locales llevar a cabo ataques de suplantación aprovechando cualquier acceso de inicio de sesión SSH junto con el control del sshd uid para enviar una petición MONITOR_REQ_PWNAM manipulada, relacionado con monitor.c y monitor_wrap.c. A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. • http://lists.apple.com/archives/security-announce/2015/Oct/msg00005.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html http://rhn.redhat.com/errata/RHSA-2016-0741.html http://seclists.org/fulldisclosure/2015/Aug/54 http://www.openssh.com/txt/release-7.0 http://www.openwall.com/lists/oss-security/2015/08/22/1 http://www.oracle.com/technetwork/topics/security/bulletinjan2016- • CWE-20: Improper Input Validation CWE-266: Incorrect Privilege Assignment •
CVSS: 8.5EPSS: 36%CPEs: 1EXPL: 1CVE-2015-5600 – openssh: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
https://notcve.org/view.php?id=CVE-2015-5600
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list. Vulnerabilidad en la función kbdint_next_device en auth2-chall.c en sshd en OpenSSH hasta la versión 6.9, no restringe correctamente el procesamiento de dispositivos de teclado interactivo con una única conexión, lo cual facilita a atacantes remotos ejecutar un ataque de fuerza bruta o causar una denegación de servicio (mediante el consumo de la CPU) a través de una lista larga y redundante en la opción ssh -oKbdInteractiveDevices, según lo demostrado por una modificación en el cliente que provee una contraseña diferente para cada uno de los elementos pam de la lista. It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks. • http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697 http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.html http://lists& • CWE-264: Permissions, Privileges, and Access Controls CWE-304: Missing Critical Step in Authentication •