PT-2015-3403 · Openbsd+1 · Openssh+1

Jann Horn · Publicado 2015-08-11 · Atualizado 2024-07-08 · CVE-2015-6565

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH versions 6.8 through 6.9

Description The issue is related to the sshd service in OpenSSH, which has inadequate access control for certain functions. This allows local users to cause a denial of service, specifically terminal disruption, or possibly have other unspecified impacts by writing to a device, such as writing an escape sequence.

Recommendations For OpenSSH versions 6.8 and 6.9, consider restricting access to the TTY devices to prevent local users from writing to them and causing a denial of service. As a temporary workaround, consider disabling the world-writable permissions for TTY devices until a patch is available.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2021-03294

CVE-2015-6565

Produtos afetados

Alt Linux

Openssh

Referências · 364

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_enumusers.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_version.rb · Exploit
• 🔥 https://github.com/Rhynorater/CVE-2018-15473-Exploit · Exploit
• 🔥 https://github.com/zgzhang/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/xaitax/CVE-2024-6387_Check · Exploit
• 🔥 https://github.com/acrono/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/asterictnl-lvdw/CVE-2024-6387 · Exploit
• 🔥 https://github.com/cpandya2909/CVE-2020-15778 · Exploit
• 🔥 https://github.com/lflare/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/epi052/cve-2018-15473 · Exploit
• 🔥 https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2016-6210 · Exploit
• 🔥 https://github.com/Christbowel/CVE-2023-25136 · Exploit
• 🔥 https://github.com/l0n3m4n/CVE-2024-6387 · Exploit
• 🔥 https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker · Exploit
• 🔥 https://github.com/vin01/poc-proxycommand-vulnerable · Exploit