PT-2006-5125 · Openssh+1 · Sshd+1

Published 2006-08-23 · Updated 2017-07-20 · CVE-2006-4316

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SSH Tectia Management Agent version 2.1.2

Description The issue allows local users to gain root privileges by exploiting a flaw in the Management Agent. When the "Restart" action is selected from the Management server GUI, the agent locates the pathname of the user's program, in this case, a program called sshd, and restarts it with root privileges.

Recommendations For SSH Tectia Management Agent version 2.1.2, consider restricting access to the Management server GUI to prevent unauthorized users from selecting the "Restart" action, which could lead to exploitation. As a temporary workaround, consider disabling the sshd program or restricting its execution to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4316

Affected Products

Ssh Tectia Management Agent

Sshd

References · 7

• http://ssh.com/company/news/2006/english/security/article/776 · Patch
• http://secunia.com/advisories/21559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4316 · Security Note
• http://securityfocus.com/bid/19677 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28561 · Note
• http://securitytracker.com/id?1016744 · Note
• http://osvdb.org/28159 · Note