Discover Government News

Arch Linux Security Advisory ASA-201612-20
=========================================
Severity: Medium
Date    : 2016-12-22
CVE-ID  : CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012
Package : openssh
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-110

Summary
======
The package openssh before version 7.4p1-1 is vulnerable to multiple
issues including arbitrary code execution, privilege escalation,
information disclosure and insufficient validation.

Resolution
=========
Upgrade to 7.4p1-1.

# pacman -Syu "openssh>=7.4p1-1"

The problems have been fixed upstream in version 7.4p1.

Workaround
=========
None.

Description
==========
- CVE-2016-10009 (arbitrary code execution)

It was found that ssh-agent could load PKCS#11 modules from paths
outside of a trusted whitelist. An attacker able to load a crafted
PKCS#11 module across a forwarded agent channel could potentially use
this flaw to execute arbitrary code on the system running the ssh-agent. Note that the attacker must have control of the forwarded agent-socket and the ability to write to the filesystem of the host running
ssh-agent.

- CVE-2016-10010 (privilege escalation)

It was found that when privilege separation was disabled in OpenSSH,
forwarded Unix-domain sockets would be created by sshd with root
privileges instead of the privileges of the authenticated user. This
could allow an authenticated attacker to potentially gain root
privileges on the host system.
Privileges separation has been enabled by default since OpenSSH
3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An
affected OpenSSH configuration would have to specifically disable
privilege separation with the "UsePrivilegeSeparation no" configuration
directive in  /etc/ssh/sshd_config.

- CVE-2016-10011 (information disclosure)

It was found that there is a theoretical leak of host private key
material to privilege-separated child processes via realloc() when
reading keys. No such leak was observed in practice for normal-sized
keys, nor does a leak to the child processes directly expose key
material to unprivileged users.

- CVE-2016-10012 (insufficient validation)

It was found that the shared memory manager used by pre-authentication
compression support had a bounds checks that could be elided by some
optimizing compilers. Additionally, this memory manager was incorrectly
accessible when pre-authentication compression was disabled. This could
potentially allow attacks against the privileged monitor process from
the sandboxed privilege-separation process (a compromise of the latter
would be required first).

Impact
=====
A remote attacker may be able to perform attacks against the shared
memory manager used by pre-authentication compression support.
Furthermore a local attacker may be able to execute arbitrary code and
disclose sensitive information under certain circumstances or possibly
escalate privileges when having privilege separation explicitly
disabled.

References
=========
https://www.openssh.com/txt/release-7.4
https://seclists.org/oss-sec/2016/q4/708
https://seclists.org/oss-sec/2016/q4/705
https://access.redhat.com/security/cve/CVE-2016-10009
https://access.redhat.com/security/cve/CVE-2016-10010
https://access.redhat.com/security/cve/CVE-2016-10011
https://access.redhat.com/security/cve/CVE-2016-10012

ArchLinux: 201612-20: openssh: multiple issues

December 23, 2016

Summary

- CVE-2016-10009 (arbitrary code execution) It was found that ssh-agent could load PKCS#11 modules from paths outside of a trusted whitelist. An attacker able to load a crafted PKCS#11 module across a forwarded agent channel could potentially use this flaw to execute arbitrary code on the system running the ssh-agent. Note that the attacker must have control of the forwarded agent-socket and the ability to write to the filesystem of the host running ssh-agent.
- CVE-2016-10010 (privilege escalation)
It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system. Privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in /etc/ssh/sshd_config.
- CVE-2016-10011 (information disclosure)
It was found that there is a theoretical leak of host private key material to privilege-separated child processes via realloc() when reading keys. No such leak was observed in practice for normal-sized keys, nor does a leak to the child processes directly expose key material to unprivileged users.
- CVE-2016-10012 (insufficient validation)
It was found that the shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimizing compilers. Additionally, this memory manager was incorrectly accessible when pre-authentication compression was disabled. This could potentially allow attacks against the privileged monitor process from the sandboxed privilege-separation process (a compromise of the latter would be required first).

Resolution

Upgrade to 7.4p1-1. # pacman -Syu "openssh>=7.4p1-1"
The problems have been fixed upstream in version 7.4p1.

References

https://www.openssh.com/txt/release-7.4 https://seclists.org/oss-sec/2016/q4/708 https://seclists.org/oss-sec/2016/q4/705 https://access.redhat.com/security/cve/CVE-2016-10009 https://access.redhat.com/security/cve/CVE-2016-10010 https://access.redhat.com/security/cve/CVE-2016-10011 https://access.redhat.com/security/cve/CVE-2016-10012

Severity
Package : openssh
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-110

Workaround

None.

Related News