CVE-2015-6563

Vulnerabilidad en el componente monitor en sshd en OpenSSH en versiones anteriores a 7.0 en plataformas no OpenBSD, acepta datos de nombre de usuario extraños en las solicitudes MONITOR_REQ_PAM_INIT_CTX, lo que permite a usuarios locales llevar a cabo ataques de suplantación aprovechando cualquier acceso de inicio de sesión SSH junto con el control del sshd uid para enviar una petición MONITOR_REQ_PWNAM manipulada, relacionado con monitor.c y monitor_wrap.c.

A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users.

OpenSSH is OpenBSD's SSH protocol implementation. These packages include the core files necessary for both the OpenSSH client and server. A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges.