PT-2023-3666 · Openssh+13 · Openssh+13

Baba Yaga · Publicado 2023-07-19 · Atualizado 2026-05-13 · CVE-2023-38408

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH versions 7.9p1-alt4.gost.p10.1, 7.9p1-alt4.p10.6, 9.6p1-alt1.gost, 9.6p1-alt2.gost

Description OpenSSH contains a vulnerability where the ssh-agent component incorrectly handles loading certain PKCS#11 providers. This can allow a remote attacker to execute arbitrary code if a user has forwarded their ssh-agent to an untrusted system and that system contains malicious libraries. The vulnerability exists due to improper handling of library loading, potentially leading to the execution of untrusted code.

Recommendations Update OpenSSH to version 7.9p1-alt4.gost.p10.1, 7.9p1-alt4.p10.6, 9.6p1-alt1.gost, or 9.6p1-alt2.gost.

Exploit

Correção

LPE

RCE

Untrusted Search Path

Code Injection

Enumeração de Fraquezas

CWE-426

CWE-428

CWE-94

Identificadores relacionados

ALSA-2023:4412

ALSA-2023:4419

ALSA-2023_4412

ALSA-2023_4419

ALSA-2024_1130

ALSA-2024_1150

ALSA-2025_16880

ALT-PU-2023-4471

ALT-PU-2023-4472

ALT-PU-2023-4480

ALT-PU-2023-4654

ALT-PU-2024-12010

ALT-PU-2024-12012

ALT-PU-2024-17672

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-7269

ALT-PU-2024-9513

AZL-27651

BDU:2023-03950

CESA-2023_4382

CESA-2023_4419

CVE-2023-38408

DLA-3532-1

ELSA-2023-4382

ELSA-2023-4412

ELSA-2023-4419

ELSA-2023-4428

FREEBSD-SA-23_08

JLSEC-2026-68

MGASA-2024-0010

OESA-2023-1480

OPENSUSE-SU-2023_2945-1

OPENSUSE-SU-2024:13063-1

RHSA-2023:4329

RHSA-2023:4381

RHSA-2023:4382

RHSA-2023:4383

RHSA-2023:4384

RHSA-2023:4412

RHSA-2023:4413

RHSA-2023:4419

RHSA-2023:4428

RHSA-2023_4382

RHSA-2023_4412

RHSA-2023_4419

RLSA-2023:4419

RLSA-2023_4419

ROSA-SA-2023-2229

SUSE-SU-2023:2940-1

SUSE-SU-2023:2945-1

SUSE-SU-2023:2946-1

SUSE-SU-2023:2947-1

SUSE-SU-2023:2950-1

SUSE-SU-2023_2940-1

SUSE-SU-2023_2945-1

SUSE-SU-2023_2946-1

SUSE-SU-2023_2947-1

SUSE-SU-2023_2950-1

USN-6242-1

USN-6242-2

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Freebsd

Ibm Aix

Linuxmint

Apple Macos

Openssh

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 162

• 🔥 https://github.com/kali-mx/CVE-2023-38408 · Exploit
• 🔥 https://github.com/LucasPDiniz/CVE-2023-38408 · Exploit
• 🔥 https://github.com/snowcra5h/CVE-2023-38408 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2023/07/20/1 · Exploit
• 🔥 https://qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html · Exploit
• https://github.com/openssh/openssh-portable/commit/099cdf59ce1e72f55d421c8445bf6321b3004755 · Nota
• https://github.com/openssh/openssh-portable/commit/892506b13654301f69f9545f48213fc210e5c5cc · Nota
• https://github.com/openssh/openssh-portable/commit/29ef8a04866ca14688d5b7fed7b8b9deab851f77 · Nota
• https://github.com/openssh/openssh-portable/commit/1f2731f5d7a8f8a8385c6031667ed29072c0d92a · Nota
• https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 · Correção
• https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d · Correção
• https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca · Correção
• https://t.me/breachdetector/319945 · Publicação no Telegram
• https://twitter.com/reverseame/status/1704371566396551171 · Publicação no Twitter