PT-2017-1237 · Openssh+6 · Openssh+6

Jann Horn

·

Publicado

2017-01-04

·

Atualizado

2024-07-08

·

CVE-2016-10012

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.4
Description The issue is related to a buffer overflow in the shared memory manager of the sshd daemon in OpenSSH, which can be exploited by a local attacker to gain privileges. This is achieved by leveraging access to a sandboxed privilege-separation process, specifically related to the m zback and m zlib data structures.
Recommendations For versions prior to 7.4, update to version 7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the privilege-separation process to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

ALT-PU-2018-2598
ALT-PU-2024-3921
ALT-PU-2024-4077
ALT-PU-2024-4467
ALT-PU-2024-9513
BDU:2017-00350
CESA-2017_2029
CVE-2016-10012
DLA-1500-1
MGASA-2018-0006
OPENSUSE-SU-2024:11124-1
RHSA-2017:2029
RHSA-2017_2029
SUSE-SU-2017:0264-1
SUSE-SU-2018:2275-1
SUSE-SU-2018:2685-1
SUSE-SU-2018:2719-1
SUSE-SU-2018:3540-1
USN-3538-1

Produtos afetados

Alt Linux
Centos
Ibm Aix
Openssh
Red Hat
Suse
Ubuntu