PT-2014-8920 · Openssh+2 · Openssh+2

Publicado 2014-12-06 · Atualizado 2017-09-08 · CVE-2014-9278

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions (affected versions not specified)

Description The issue concerns the OpenSSH server when running in a Kerberos environment, allowing remote authenticated users to log in as another user if they are listed in the .k5users file of that user. This could potentially bypass intended authentication requirements that would force a local login.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CESA-2015_0425

CVE-2014-9278

RHSA-2015:0425

RHSA-2015_0425

Produtos afetados

Centos

Openssh

Red Hat

Referências · 29

• http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855 · Nota
• https://access.redhat.com/errata/RHSA-2015:0425 · Nota
• https://access.redhat.com/security/cve/CVE-2014-9278 · Nota
• https://bdu.fstec.ru/vul/2015-04127 · Nota de Segurança
• http://securityfocus.com/bid/71420 · Nota
• http://openwall.com/lists/oss-security/2014/12/02/3 · Nota
• https://bdu.fstec.ru/vul/2015-06146 · Nota de Segurança
• https://lists.centos.org/pipermail/centos-cr-announce/2015-March/027995.html · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1169843 · Nota
• https://bdu.fstec.ru/vul/2015-06145 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/12/04/17 · Nota
• https://access.redhat.com/security/cve/CVE-2014-2653 · Nota
• https://linux.oracle.com/errata/ELSA-2015-0425.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-06147 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99090 · Nota