Bug 1252844 (CVE-2015-6563) - CVE-2015-6563 openssh: Privilege separation weakness related to PAM support
Summary: CVE-2015-6563 openssh: Privilege separation weakness related to PAM support
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-6563
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1252854 1265807 1281468
Blocks: 1210268 1252864 1278736
TreeView+ depends on / blocked
 
Reported: 2015-08-12 11:10 UTC by Adam Mariš
Modified: 2019-10-10 10:03 UTC (History)
15 users (show)

Fixed In Version: openssh 7.0
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users.
Clone Of:
Environment:
Last Closed: 2016-05-11 06:45:56 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2088 normal SHIPPED_LIVE Moderate: openssh security, bug fix, and enhancement update 2015-11-19 08:38:51 UTC
Red Hat Knowledge Base (Solution) 1580743 None None None Never
Red Hat Product Errata RHSA-2016:0741 normal SHIPPED_LIVE Moderate: openssh security, bug fix, and enhancement update 2016-05-10 22:29:45 UTC

Description Adam Mariš 2015-08-12 11:10:35 UTC
Privilege seaparation weakness related to PAM support allowing the attacker to impersonate other users was found in openssh package. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users.

Upstream patch:

https://anongit.mindrot.org/openssh.git/commit/?id=d4697fe9a28dab7255c60433e4dd23cf7fce8a8b

CVE request:

http://seclists.org/oss-sec/2015/q3/319

External References:

http://www.openssh.com/txt/release-7.0

Comment 1 Adam Mariš 2015-08-12 11:26:55 UTC
Created openssh tracking bugs for this issue:

Affects: fedora-all [bug 1252854]

Comment 2 Vasyl Kaigorodov 2015-08-13 12:26:05 UTC
Additional info from CVE request thread (http://seclists.org/oss-sec/2015/q3/343):

```
The vulnerable code for the two privsep issues was introduced with the merge of the FreeBSD PAM code in 2003:

https://github.com/openssh/openssh-portable/commit/4f9f42a9bb6a6aa8f6100d873dc6344f2f9994de
```

Comment 3 Fedora Update System 2015-08-18 05:19:31 UTC
openssh-7.0p1-1.fc23 has been pushed to the Fedora 23 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-08-19 08:15:47 UTC
openssh-6.9p1-5.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Slawomir Czarko 2015-08-25 08:09:16 UTC
Is this CVE-2015-6563? The patches look the same.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6563

Comment 6 Adam Mariš 2015-08-25 12:44:16 UTC
CVE assignment:

http://seclists.org/oss-sec/2015/q3/419

Comment 7 Fedora Update System 2015-08-27 23:48:54 UTC
openssh-6.6.1p1-16.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Tomas Hoger 2015-09-23 15:21:42 UTC
Further details of this issue can be found in the advisory form the original reporter that was posted to the full-disclosure mailing list:

http://seclists.org/fulldisclosure/2015/Aug/54

The advisory explicitly notes conditions required to exploit this flaw:

- Attacker has to be able to fully compromise non-privileged pre-authentication process via some different flaw.  (Note that the advisory indicates that OpenSSH introduced privilege separate support in version 5.9.  However, privilege separation support was introduced in version 3.2.2 and enabled by default in 3.3.  Version 5.9 introduced support for sandboxing of the privilege separated process.)

- Attacker has to be able to successfully authenticated to SSH on the target system.

When these conditions are met, this flaw could allow attacker to open SSH connection as different system user.

Comment 15 errata-xmlrpc 2015-11-19 08:05:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2088 https://rhn.redhat.com/errata/RHSA-2015-2088.html

Comment 18 errata-xmlrpc 2016-05-10 19:29:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0741 https://rhn.redhat.com/errata/RHSA-2016-0741.html


Note You need to log in before you can comment on or make changes to this bug.