Portable OpenSSH 'ssh-keysign' Local Unauthorized Access Vulnerability

Bugtraq ID:	47691
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	May 03 2011 12:00AM
Updated:	Jul 07 2011 04:30PM
Credit:	Tomas Mraz
Vulnerable:	Pardus Linux 2009 0 OpenSSH OpenSSH 4.2 OpenSSH OpenSSH 4.1 p1 OpenSSH OpenSSH 4.1 OpenSSH OpenSSH 4.0 p1 OpenSSH OpenSSH 4.0 OpenSSH OpenSSH 3.9 p1 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 OpenSSH OpenSSH 3.8.1 p1 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 OpenSSH OpenSSH 3.8 p1 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 OpenSSH OpenSSH 3.7.2 p1 + SCO Open Server 5.0.7 OpenSSH OpenSSH 3.7.1 p2 OpenSSH OpenSSH 3.7.1 p1 + SCO Open Server 5.0.7 OpenSSH OpenSSH 3.7.1 OpenSSH OpenSSH 3.7 p1 OpenSSH OpenSSH 3.7 .1p2 OpenSSH OpenSSH 3.7 OpenSSH OpenSSH 3.6.1 p2 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Linux Mandrake 9.1 ppc + MandrakeSoft Linux Mandrake 9.1 + MandrakeSoft Linux Mandrake 9.0 + MandrakeSoft Linux Mandrake 8.2 ppc + MandrakeSoft Linux Mandrake 8.2 + MandrakeSoft Multi Network Firewall 2.0 + Trustix Secure Linux 2.0 OpenSSH OpenSSH 3.6.1 p1 + OpenPKG OpenPKG Current + Slackware Linux 9.0 + Slackware Linux -current OpenSSH OpenSSH 3.6.1 + Novell Netware 6.5 OpenSSH OpenSSH 3.5 p1 + Conectiva Linux 9.0 + OpenPKG OpenPKG 1.2 + RedHat Linux 9.0 i386 + S.u.S.E. Linux Personal 8.2 + Terra Soft Solutions Yellow Dog Linux 3.0 OpenSSH OpenSSH 3.5 OpenSSH OpenSSH 3.4 p1-7 OpenSSH OpenSSH 3.4 p1-6 OpenSSH OpenSSH 3.4 p1-5 OpenSSH OpenSSH 3.4 p1-4 OpenSSH OpenSSH 3.4 p1-3 OpenSSH OpenSSH 3.4 p1-2 OpenSSH OpenSSH 3.4 p1-1 OpenSSH OpenSSH 3.4 p1 + Conectiva Linux 8.0 + Conectiva Linux 7.0 + Conectiva Linux 6.0 + Conectiva Linux Enterprise Edition 1.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + FreeBSD FreeBSD 5.0 + FreeBSD FreeBSD 4.7 -RELEASE + FreeBSD FreeBSD 4.7 + IBM AIX 5.1 L + IBM AIX 4.3.3 + Immunix Immunix OS 7+ + RedHat Linux 8.0 + S.u.S.E. Linux 8.1 + S.u.S.E. Linux 8.0 + Slackware Linux 8.1 OpenSSH OpenSSH 3.4 OpenSSH OpenSSH 3.3 p1 + Conectiva Linux 8.0 + Conectiva Linux 7.0 + Conectiva Linux 6.0 OpenSSH OpenSSH 3.3 + Openwall Openwall GNU/*/Linux (Owl)-current OpenSSH OpenSSH 5.8 OpenSSH OpenSSH 5.7 OpenSSH OpenSSH 5.6 OpenSSH OpenSSH 5.5 OpenSSH OpenSSH 5.4 OpenSSH OpenSSH 5.3 OpenSSH OpenSSH 5.2p1 OpenSSH OpenSSH 5.2 OpenSSH OpenSSH 5.1 OpenSSH OpenSSH 5.0 OpenSSH OpenSSH 4.9 OpenSSH OpenSSH 4.8 OpenSSH OpenSSH 4.7p1 OpenSSH OpenSSH 4.7 OpenSSH OpenSSH 4.6p1 OpenSSH OpenSSH 4.6 OpenSSH OpenSSH 4.5 OpenSSH OpenSSH 4.4.p1 OpenSSH OpenSSH 4.4 OpenSSH OpenSSH 4.3p2 OpenSSH OpenSSH 4.3p1 OpenSSH OpenSSH 4.2p1
Not Vulnerable:	OpenSSH OpenSSH 5.8 p2

Portable OpenSSH 'ssh-keysign' Local Unauthorized Access Vulnerability

Portable OpenSSH is prone to a local unauthorized-access vulnerability.

Local attackers can exploit this issue to gain access to host keys on the affected computer.

Portable OpenSSH 'ssh-keysign' Local Unauthorized Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Portable OpenSSH 'ssh-keysign' Local Unauthorized Access Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

Portable OpenSSH 'ssh-keysign' Local Unauthorized Access Vulnerability

References:

• OpenSSH Homepage (OpenSSH)
  
• OpenSSH Security Advisory: portable-keysign-rand-helper.adv (OpenSSH)