SSH Communications SSH Server Privilege Escalation Vulnerability
BID:6247
Info
SSH Communications SSH Server Privilege Escalation Vulnerability
| Bugtraq ID: | 6247 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 25 2002 12:00AM |
| Updated: | Nov 25 2002 12:00AM |
| Credit: | Vulnerability announced by SSH Communications. |
| Vulnerable: |
SSH Communications Security SSH2 3.2.1 SSH Communications Security SSH2 3.2 SSH Communications Security SSH2 3.1.4 SSH Communications Security SSH2 3.1.3 SSH Communications Security SSH2 3.1.2 SSH Communications Security SSH2 3.1.1 SSH Communications Security SSH2 3.1 SSH Communications Security SSH2 3.0.1 SSH Communications Security SSH2 3.0 SSH Communications Security SSH2 2.5 SSH Communications Security SSH2 2.4 SSH Communications Security SSH2 2.3 SSH Communications Security SSH2 2.2 SSH Communications Security SSH2 2.1 SSH Communications Security SSH2 2.0.13 |
| Not Vulnerable: |
SSH Communications Security SSH2 3.2.2 SSH Communications Security SSH2 3.1.5 |
Discussion
SSH Communications SSH Server Privilege Escalation Vulnerability
SSH Communications has reported a vulnerability in SSH server, which could result in local privilege escalation.
When forking child processes for non-interactive sessions, SSH server fails to execute the setsid() function to remove the child from the parent process group. This will result in the child process retaining the 'root' login name. If a program is run that verifies a users privileges from the login name, it may be possible to execute various actions with escalated privileges.
For this issue to be exploitable an attacker must have a local account on the target system.
SSH Communications has reported a vulnerability in SSH server, which could result in local privilege escalation.
When forking child processes for non-interactive sessions, SSH server fails to execute the setsid() function to remove the child from the parent process group. This will result in the child process retaining the 'root' login name. If a program is run that verifies a users privileges from the login name, it may be possible to execute various actions with escalated privileges.
For this issue to be exploitable an attacker must have a local account on the target system.
Exploit / POC
SSH Communications SSH Server Privilege Escalation Vulnerability
No exploit is required.
No exploit is required.
References
SSH Communications SSH Server Privilege Escalation Vulnerability
References:
References:
- SSH Secure Shell Unix server setsid() function call vulnerability (VU#740619) (SSH Communications Security)
- Vulnerability Note VU#740619 (CERT)