Rapid7 Vulnerability & Exploit Database

RHSA-2001:161: Updated OpenSSH packages available

Back to Search

RHSA-2001:161: Updated OpenSSH packages available

Severity
7
CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Published
12/21/2001
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

Updated OpenSSH packages are now available for Red Hat Linux 7, 7.1, and 7.2. These packages fix a vulnerability which exists when a server is configured with the "UseLogin" option.

When the "UseLogin" option is enabled in OpenSSH, a malicious user who authenticates using key-based authentication methods can influence the environment variables passed to the login process. This could allow the user to execute arbitrary code with superuser privileges. In Red Hat Linux the OpenSSH server has the "UseLogin" option disabled by default. Therefore, it is not vulnerable unless the system administrator has changed this setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2001-0872 to this issue.

Solution(s)

  • redhat-upgrade-openssh
  • redhat-upgrade-openssh-askpass
  • redhat-upgrade-openssh-askpass-gnome
  • redhat-upgrade-openssh-clients
  • redhat-upgrade-openssh-server

References

View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;