Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability

Bugtraq ID:	36552
Class:	Unknown
CVE:	CVE-2009-2904
Remote:	No
Local:	Yes
Published:	Sep 30 2009 12:00AM
Updated:	Apr 13 2015 09:40PM
Credit:	Tomas Hoger
Vulnerable:	VMWare vMA 4.0 VMWare ESX Server 4.0 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Avaya Voice Portal 5.0 Avaya Aura Session Manager 1.1
Not Vulnerable:

Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability

Red Hat Enterprise Linux is prone to a local privilege-escalation vulnerability.

This vulnerability was introduced in the patch RHSA-2009:1287.

A local attacker can exploit this vulnerability to run arbitrary code with superuser privileges.

Red Hat Enterprise Linux 5.4 is vulnerable.

Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability

Attackers can use readily available tools to exploit this issue.

Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.

Red Hat Enterprise Linux OpenSSH 'ChrootDirectory' Option Local Privilege Escalation Vulnerability

References:

• Bug 522141 �?? CVE-2009-2904 openssh: possible privilege escalation when using Chr (Tomas Hoger)
  
• OpenSSH Homepage (OpenSSH)
  
• Red Hat Homepage (Red Hat)
  
• ASA-2009-452 (Avaya)