ArchLinux: 201612-20: openssh: multiple issues
Summary
- CVE-2016-10009 (arbitrary code execution)
It was found that ssh-agent could load PKCS#11 modules from paths
outside of a trusted whitelist. An attacker able to load a crafted
PKCS#11 module across a forwarded agent channel could potentially use
this flaw to execute arbitrary code on the system running the ssh-agent. Note that the attacker must have control of the forwarded agent-socket and the ability to write to the filesystem of the host running
ssh-agent.
- CVE-2016-10010 (privilege escalation)
It was found that when privilege separation was disabled in OpenSSH,
forwarded Unix-domain sockets would be created by sshd with root
privileges instead of the privileges of the authenticated user. This
could allow an authenticated attacker to potentially gain root
privileges on the host system.
Privileges separation has been enabled by default since OpenSSH
3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An
affected OpenSSH configuration would have to specifically disable
privilege separation with the "UsePrivilegeSeparation no" configuration
directive in /etc/ssh/sshd_config.
- CVE-2016-10011 (information disclosure)
It was found that there is a theoretical leak of host private key
material to privilege-separated child processes via realloc() when
reading keys. No such leak was observed in practice for normal-sized
keys, nor does a leak to the child processes directly expose key
material to unprivileged users.
- CVE-2016-10012 (insufficient validation)
It was found that the shared memory manager used by pre-authentication
compression support had a bounds checks that could be elided by some
optimizing compilers. Additionally, this memory manager was incorrectly
accessible when pre-authentication compression was disabled. This could
potentially allow attacks against the privileged monitor process from
the sandboxed privilege-separation process (a compromise of the latter
would be required first).
Resolution
Upgrade to 7.4p1-1.
# pacman -Syu "openssh>=7.4p1-1"
The problems have been fixed upstream in version 7.4p1.
References
https://www.openssh.com/txt/release-7.4 https://seclists.org/oss-sec/2016/q4/708 https://seclists.org/oss-sec/2016/q4/705 https://access.redhat.com/security/cve/CVE-2016-10009 https://access.redhat.com/security/cve/CVE-2016-10010 https://access.redhat.com/security/cve/CVE-2016-10011 https://access.redhat.com/security/cve/CVE-2016-10012
Workaround
None.
