CVE-2015-5352
openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.
Vulnerabilidad en la función x11_open_helper en channels.c en ssh en OpenSSH en versiones anteriores a 6.9, cuando no se utiliza el modo ForwardX11Trusted, carece de una verificación de tiempo límite para conexiones X, lo que facilita a atacantes remotos eludir la restricción destinada al acceso a través de una conexión fuera de la ventana de tiempo permitida.
It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-07-01 CVE Reserved
- 2015-07-09 CVE Published
- 2024-05-23 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (17)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html | 2022-12-13 | |
| http://rhn.redhat.com/errata/RHSA-2016-0741.html | 2022-12-13 | |
| http://www.openssh.com/txt/release-6.9 | 2022-12-13 | |
| http://www.ubuntu.com/usn/USN-2710-1 | 2022-12-13 | |
| http://www.ubuntu.com/usn/USN-2710-2 | 2022-12-13 | |
| https://security.gentoo.org/glsa/201512-04 | 2022-12-13 | |
| https://access.redhat.com/security/cve/CVE-2015-5352 | 2016-05-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1238231 | 2016-05-10 |