The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory6 | — | — | Nov 16, 2015 | Aug 23, 2015 |
| Aix 6.1 Openssh_advisory6 | — | — | Nov 16, 2015 | Aug 23, 2015 |
| Aix 7.1 Openssh_advisory6 | — | — | Nov 16, 2015 | Aug 23, 2015 |
| Alpine Linux | — | Upgrade openssh | Aug 30, 2017 | Aug 23, 2015 |
| Apple Osx Accelerateframework | — | Upgrade macOS to the latest versionApply OS X security update 2015-007 | Oct 22, 2015 | Aug 23, 2015 |
| Apple Osx Openssh | — | Upgrade macOS to the latest version | Mar 29, 2016 | Aug 23, 2015 |
| Debian | — | Upgrade openssh | Jul 30, 2024 | Aug 24, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 17, 2015 |
| Freebsd | — | Upgrade openssh-portableUpgrade FreeBSD | Dec 10, 2025 | Aug 21, 2015 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Aug 23, 2015 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory7Apply the fix or workaround for openssh_advisory6 | Nov 30, 2017 | Aug 23, 2015 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.0 | Aug 26, 2015 | Aug 24, 2015 |
| Oracle Solaris | — | Upgrade network/openssh to version 7.1.0.1-0.175.3.5.0.5.0 on Solaris 11.3 | May 29, 2017 | Aug 23, 2015 |
| Oracle_linux | — | Upgrade openssh-clientsUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-keycatUpgrade openssh-askpassUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinit | May 12, 2016 | Aug 24, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 11, 2015 |
| Suse | — | Upgrade openssh-openssl1-helpersUpgrade opensshUpgrade openssh-openssl1Upgrade openssh-fipsUpgrade openssh-askpassUpgrade openssh-helpersUpgrade openssh-askpass-gnome | Dec 18, 2015 | Aug 23, 2015 |
| Ubuntu | — | Upgrade openssh | Nov 19, 2024 | Aug 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub