Vulnerability Note VU#157447

OpenSSH UseLogin directive permits privilege escalation

Overview

OpenSSH is an implementation of the Secure Shell protocol. When OpenSSH is configured with the UseLogin directive equal to "yes", an intruder can execute arbitrary code with the privileges of OpenSSH, usually root.

I. Description

OpenSSH contains a vulnerability that permits an intruder to execute arbitrary code. When the UseLogin directive is enabled, a user can set environment variables that are used by login. An intruder can use this vulnerability to execute commands with the privileges of OpenSSH, usually root. UseLogin is not enabled by default; however, it is a common configuration. The intruder must be able to authenticate to the system using public key authentication.

This vulnerability is not related to VU#40327 (https://www.kb.cert.org/vuls/id/40327).

II. Impact

An intruder can use this vulnerability to execute commands with the privileges of OpenSSH, usually root.

III. Solution

OpenSSH 3.0.2 resolves this vulnerability and is available at ftp://ftp.openbsd.com/pub/OpenBSD/OpenSSH/openssh-3.0.2.tgz.

We strongly encourage you to review your configuration to determine whether or not UseLogin is enabled. If the use of UseLogin is required at your site, you may wish to temporarily disable access to the SSH service until a patch can be applied.

Systems Affected

Vendor	Status	Date Notified
BSDI	Vulnerable	10-Dec-2001
Caldera	Vulnerable	17-Dec-2001
Debian	Vulnerable	5-Dec-2001
F-Secure	Not Vulnerable	11-Dec-2001
FreeBSD	Vulnerable	7-Dec-2001
Fujitsu	Not Vulnerable	11-Dec-2001
Hewlett Packard	Not Vulnerable	13-Dec-2001
IBM	Vulnerable	4-Dec-2001
MandrakeSoft	Vulnerable	14-Dec-2001
OpenBSD	Vulnerable	4-Dec-2001
OpenSSH	Vulnerable	4-Dec-2001
Red Hat	Vulnerable	13-Dec-2001
SSH Communications Security	Not Vulnerable	12-Dec-2001
Sun	Not Vulnerable	4-Dec-2001
SuSE	Vulnerable	7-Dec-2001
Trustix	Vulnerable	21-Dec-2001

References

http://www.securityfocus.com/bid/3614
ftp://ftp.openbsd.com/pub/OpenBSD/OpenSSH/openssh-3.0.2.tgz
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=100747128105913&w=2

Credit

The CERT/CC thanks Marcus Friedl of OpenBSD, and Jacques A. Vidrine of FreeBSD for information related to this vulnerability.

This document was written by Jason Rafail.

Other Information

Date Public:	2001-12-04
Date First Published:	2001-12-04
Date Last Updated:	2002-01-02
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	15.75
Document Revision:	15

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader