Rapid7 Vulnerability & Exploit Database

Amazon Linux AMI: Security patch for openssh (ALAS-2013-165) (CVE-2012-5536)

Back to Search

Amazon Linux AMI: Security patch for openssh (ALAS-2013-165) (CVE-2012-5536)

Severity
6
CVSS
(AV:L/AC:H/Au:N/C:C/I:C/A:C)
Published
02/21/2013
Created
07/25/2018
Added
02/28/2014
Modified
07/04/2017

Description

A certain Red Hat build of the pam_ssh_agent_auth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error function instead of the error function in the OpenSSH codebase, which allows local users to obtain sensitive information from process memory or possibly gain privileges via crafted use of an application that relies on this module, as demonstrated by su and sudo.

Solution(s)

  • amazon-linux-upgrade-openssh
  • amazon-linux-upgrade-openssh-clients
  • amazon-linux-upgrade-openssh-debuginfo
  • amazon-linux-upgrade-openssh-ldap
  • amazon-linux-upgrade-openssh-server
  • amazon-linux-upgrade-pam_ssh_agent_auth

References

  • amazon-linux-upgrade-openssh
  • amazon-linux-upgrade-openssh-clients
  • amazon-linux-upgrade-openssh-debuginfo
  • amazon-linux-upgrade-openssh-ldap
  • amazon-linux-upgrade-openssh-server
  • amazon-linux-upgrade-pam_ssh_agent_auth

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;