PT-2013-6355 · Openssh+4 · Openssh+4

Markus Friedl · Published 1970-01-01 · Updated 2024-07-08 · CVE-2013-4548

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSSH versions 6.2 through 6.3

Description The issue allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address. This is due to the mm newkeys from blob function in monitor wrap.c not properly initializing memory for a MAC context data structure when an AES-GCM cipher is used. The vulnerability can be exploited remotely by an attacker who has passed the authentication procedure, potentially leading to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For OpenSSH versions 6.2 through 6.3, consider updating to a version where this issue is fixed, as the current version allows for the bypass of important security restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2013-1071

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2015-05680

BDU:2015-05681

BDU:2015-05682

BDU:2015-05683

BDU:2015-05684

CVE-2013-4548

HPSBUX03188

OPENSUSE-SU-2013_1726-1

Affected Products

Alt Linux

Hp-Ux

Ibm Aix

Openssh

Suse

References · 364

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_enumusers.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_version.rb · Exploit
• 🔥 https://github.com/Rhynorater/CVE-2018-15473-Exploit · Exploit
• 🔥 https://github.com/zgzhang/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/xaitax/CVE-2024-6387_Check · Exploit
• 🔥 https://github.com/acrono/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/asterictnl-lvdw/CVE-2024-6387 · Exploit
• 🔥 https://github.com/cpandya2909/CVE-2020-15778 · Exploit
• 🔥 https://github.com/lflare/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/epi052/cve-2018-15473 · Exploit
• 🔥 https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2016-6210 · Exploit
• 🔥 https://github.com/Christbowel/CVE-2023-25136 · Exploit
• 🔥 https://github.com/l0n3m4n/CVE-2024-6387 · Exploit
• 🔥 https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker · Exploit
• 🔥 https://github.com/vin01/poc-proxycommand-vulnerable · Exploit