PT-2014-2168 · Openssh+1 · Openssh+1

Published 2014-02-03 · Updated 2024-07-08 · CVE-2011-4327

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 5.8p2

Description The issue allows local users to obtain sensitive key information via the ptrace system call due to unintended open file descriptors when executing ssh-rand-helper in ssh-keysign.c.

Recommendations For versions prior to 5.8p2, update to version 5.8p2 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

CVE-2011-4327

Affected Products

Alt Linux

Openssh

References · 3

• http://openssh.com/txt/portable-keysign-rand-helper.adv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4327 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=755640 · Note