PT-2008-4650 · Openssh+1 · Openssh+1

Kingcope · Published 2008-07-18 · Updated 2017-09-29 · CVE-2008-3234

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenSSH version 4 OpenSSH snapshot 20070303

Description: The issue allows remote authenticated users to gain access to arbitrary SELinux roles. This is achieved by appending a :/ sequence, followed by the role name, to the username.

Recommendations: For OpenSSH version 4, update to a version that fixes this issue. For OpenSSH snapshot 20070303, update to a newer snapshot that includes the fix. As a temporary workaround, consider restricting access to SELinux roles until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3234

ECHO-003F-2632-599C

Affected Products

Debian

Openssh

References · 7

• 🔥 https://exploit-db.com/exploits/6094 · Exploit
• 🔥 http://securityfocus.com/bid/30276 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2008-3234 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3234 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3234 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44037 · Note