SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   OpenSSH Vendors:   OpenSSH.org
(Debian Issues Fix) OpenSSH UseLogin Environment Variable Bug Lets Local Users Execute Commands and Gain Root Access
SecurityTracker Alert ID:  1002906
SecurityTracker URL:  http://securitytracker.com/id/1002906
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 5 2001
Impact:   Execution of arbitrary code via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0.1 and prior
Description:   A vulnerability was reported in OpenSSH that may allow a local user to cause arbitrary commands to be executed with root level privileges, giving the user root level access on the system.

The vulnerability reportedly resides in the UseLogin option of OpenSSH. This option is apparently not part of the default configuration. A local user can pass environment variables (e.g. LD_PRELOAD) to the login process, which is run with the same privilege as sshd (typically this is a root level process). This could allow a local user to cause arbitrary commands to be executed with root level privileges, giving the local user root access on the system.

Impact:   A local user could cause arbitrary commands to be executed with root level privileges, giving the local user root access on the system.
Solution:   The vendor has released a fix in version 1:1.2.3-9.4.

Debian GNU/Linux 2.2 alias potato
- ---------------------------------

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

Source archives:
http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.diff.gz
MD5 checksum: a3600ed331f986cf4c9e8999bc5d69cb
http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.dsc
MD5 checksum: 30c2e9775b9bbb214afd95a731e0f482
http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3.orig.tar.gz
MD5 checksum: 6aad0cc9ceca55f138ed1ba4cf660349

Architecture independent archives:
http://security.debian.org/dists/stable/updates/main/binary-all/ssh-askpass-ptk_1.2.3-9.4_all.deb
MD5 checksum: eb61f2cbd0a985ad91460676c54e8234

Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-askpass-gnome_1.2.3-9.4_alpha.deb
MD5 checksum: a1ff36aea22f0c93c6800fb1a282c15a
http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_1.2.3-9.4_alpha.deb
MD5 checksum: 5cae8437e415dd274d9de6ad86bd293a

ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/ssh-askpass-gnome_1.2.3-9.4_arm.deb
MD5 checksum: 5d5df2cda09d9edaf17c24d5cfe7c4a3
http://security.debian.org/dists/stable/updates/main/binary-arm/ssh_1.2.3-9.4_arm.deb
MD5 checksum: 88eaecbcf5f1e2a8fc4a1a5bffb7dad2

Intel IA-32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-askpass-gnome_1.2.3-9.4_i386.deb
MD5 checksum: 174cc64dbb0996cd09d58f2691817dbf
http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1.2.3-9.4_i386.deb
MD5 checksum: 1426d1c8d424b8af6e94a1eec87075aa

Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-askpass-gnome_1.2.3-9.4_m68k.deb
MD5 checksum: 78c897a689e04ffd20e1b0230b85f452
http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1.2.3-9.4_m68k.deb
MD5 checksum: e0ca14452953a318dec512b739f8fec4

PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh-askpass-gnome_1.2.3-9.4_powerpc.deb
MD5 checksum: 17bdb2cc2381defd4fb10bb963de9c19
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh_1.2.3-9.4_powerpc.deb
MD5 checksum: 8f80b6a56f437589edbeb0ca2c3321e3

Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-askpass-gnome_1.2.3-9.4_sparc.deb
MD5 checksum: a65d2465bb5372a5153b2c5afd4929ec
http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_1.2.3-9.4_sparc.deb
MD5 checksum: 687aa2c7dd8295b1c6bb0cac5d6c6c06

These packages will be moved into the stable distribution on its next
revision.

For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/

See the Source Message for the vendor's advisory containing directions on how to apply the appropriate fix.

Vendor URL:  www.openssh.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Debian)

Message History:   This archive entry is a follow-up to the message listed below.
Dec 4 2001 OpenSSH UseLogin Environment Variable Bug Lets Local Users Execute Commands and Gain Root Access



 Source Message Contents

Subject:  [SECURITY] [DSA-091-1] OpenSSH UseLogin vulnerability


-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory DSA-091-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
December  5, 2001
- ------------------------------------------------------------------------


Package        : ssh
Problem type   : influencing login 
Debian-specific: no

If the UseLogin feature is enabled in for ssh local users could
pass environment variables (including variables like LD_PRELOAD)
to the login process. This has been fixed by not copying the
environment of UseLogin is enabled.

Please note that the default configuration for Debian does not
have the UseLogin enabled.

This has been fixed in version 1:1.2.3-9.4.


wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

  Source archives:
    http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.diff.gz
      MD5 checksum: a3600ed331f986cf4c9e8999bc5d69cb
    http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.dsc
      MD5 checksum: 30c2e9775b9bbb214afd95a731e0f482
    http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3.orig.tar.gz
      MD5 checksum: 6aad0cc9ceca55f138ed1ba4cf660349

  Architecture independent archives:
    http://security.debian.org/dists/stable/updates/main/binary-all/ssh-askpass-ptk_1.2.3-9.4_all.deb
      MD5 checksum: eb61f2cbd0a985ad91460676c54e8234

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-askpass-gnome_1.2.3-9.4_alpha.deb
      MD5 checksum: a1ff36aea22f0c93c6800fb1a282c15a
    http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_1.2.3-9.4_alpha.deb
      MD5 checksum: 5cae8437e415dd274d9de6ad86bd293a

  ARM architecture:
    http://security.debian.org/dists/stable/updates/main/binary-arm/ssh-askpass-gnome_1.2.3-9.4_arm.deb
      MD5 checksum: 5d5df2cda09d9edaf17c24d5cfe7c4a3
    http://security.debian.org/dists/stable/updates/main/binary-arm/ssh_1.2.3-9.4_arm.deb
      MD5 checksum: 88eaecbcf5f1e2a8fc4a1a5bffb7dad2

  Intel IA-32 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-askpass-gnome_1.2.3-9.4_i386.deb
      MD5 checksum: 174cc64dbb0996cd09d58f2691817dbf
    http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1.2.3-9.4_i386.deb
      MD5 checksum: 1426d1c8d424b8af6e94a1eec87075aa

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-askpass-gnome_1.2.3-9.4_m68k.deb
      MD5 checksum: 78c897a689e04ffd20e1b0230b85f452
    http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1.2.3-9.4_m68k.deb
      MD5 checksum: e0ca14452953a318dec512b739f8fec4

  PowerPC architecture:
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh-askpass-gnome_1.2.3-9.4_powerpc.deb
      MD5 checksum: 17bdb2cc2381defd4fb10bb963de9c19
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh_1.2.3-9.4_powerpc.deb
      MD5 checksum: 8f80b6a56f437589edbeb0ca2c3321e3

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-askpass-gnome_1.2.3-9.4_sparc.deb
      MD5 checksum: a65d2465bb5372a5153b2c5afd4929ec
    http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_1.2.3-9.4_sparc.deb
      MD5 checksum: 687aa2c7dd8295b1c6bb0cac5d6c6c06

  These packages will be moved into the stable distribution on its next
  revision.

For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

- -- 
- ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBPA4wTqjZR/ntlUftAQEsvwMAqUHBE3Txen0Qc9Wufm+FdZV+fy1hvSZK
5r9UH91aq2DbKtsdv3oEb9aybsYv25g0FbcWrpnTGLzq3dYzTtgQOvdctIsCgSzW
bVUyLI1rzrNT5pHOF6XmHzbeSTuApTM/
=WiYQ
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC