PT-2014-8920 · Openssh+2 · Openssh+2

Published 2014-12-06 · Updated 2017-09-08 · CVE-2014-9278

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions (affected versions not specified)

Description The issue concerns the OpenSSH server when running in a Kerberos environment, allowing remote authenticated users to log in as another user if they are listed in the .k5users file of that user. This could potentially bypass intended authentication requirements that would force a local login.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CESA-2015_0425

CVE-2014-9278

RHSA-2015:0425

RHSA-2015_0425

Affected Products

Centos

Openssh

Red Hat

References · 29

• https://bdu.fstec.ru/vul/2015-04127 · Security Note
• https://bdu.fstec.ru/vul/2015-06146 · Security Note
• https://bdu.fstec.ru/vul/2015-06145 · Security Note
• https://linux.oracle.com/errata/ELSA-2015-0425.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06147 · Security Note
• https://bdu.fstec.ru/vul/2015-06148 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2653 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9278 · Security Note
• https://bdu.fstec.ru/vul/2015-06150 · Security Note
• https://bdu.fstec.ru/vul/2015-06149 · Security Note
• https://bdu.fstec.ru/vul/2015-06151 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-0425.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9278 · Security Note
• http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855 · Note
• https://access.redhat.com/errata/RHSA-2015:0425 · Note