OpenSSH sshd monitor component Spoofing Vulnerability (CVE-2015-6563)

OpenSSH sshd monitor component Spoofing Vulnerability (CVE-2015-6563)
OpenSSH sshd monitor component Spoofing Vulnerability (CVE-2015-6563)

Release date:
Updated on:

Affected Systems:

OpenSSH OpenSSH 〈 7.0
OpenSSH OpenSSH

Description:

CVE (CAN) ID: CVE-2015-6563

OpenSSH is an open-source implementation of the SSH protocol.

In versions earlier than OpenSSH 7.0 on the OpenBSD platform, the monitor component in the sshd accepts username data irrelevant to the MONITOR_REQ_PAM_INIT_CTX request. This allows local users to log on to the server using ssh and control the sshd uid, send the constructed MONITOR_REQ_PWNAM request and perform simulated attacks.

<* Source: OpenSSH
*>

Suggestion:

Vendor patch:

OpenSSH
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.openssh.com/txt/release-7.0
Https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b
Http://seclists.org/fulldisclosure/2015/Aug/54

For more information about OpenSSH, see the following links:

Install and configure OpenSSH in Ubuntu Server 13.10

Install OpenSSH remotely on Ubuntu

Solve the latency problem during remote login through OpenSSH

Offline installation of OpenSSH in Ubuntu 12.10

OpenSSH upgrade steps and precautions

Solutions for failures of common OpenSSH users

General thread: OpenSSH key management, Part 1 Understanding RSA/DSA authentication

Install OpenSSH and configure the sftp lock directory for RedHat

OpenSSL details: click here
OpenSSL: click here

This article permanently updates the link address: