Severity
Medium
Vendor
OpenSSH
Versions Affected
- Ubuntu 14.04
Description
Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to perform user impersonation.
Moritz Jodeit discovered that OpenSSH incorrectly handled context memory when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to bypass authentication or possibly execute arbitrary code.
Jann Horn discovered that OpenSSH incorrectly handled time windows for X connections. A remote attacker could use this issue to bypass certain access restrictions.
It was discovered that OpenSSH incorrectly handled keyboard-interactive authentication. In a non-default configuration, a remote attacker could possibly use this issue to perform a brute-force password attack.
Note that USN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix for CVE-2015-5600 caused a regression resulting in random authentication failures in non-default configurations. USN-2710-2 update fixes the problem.
The Cloud Foundry project released a BOSH stemcell version 3048 and a cflinuxfs2 rootfs stack that have the patched version of OpenSSH.
Affected Products and Versions
Severity is medium unless otherwise noted.
- All versions of Cloud Foundry BOSH stemcells prior to 3042 have versions of OpenSSH vulnerable to USN-2710-1.
- All versions of Cloud Foundry cflinuxfs2 prior to 1.5.0 have versions of OpenSSH vulnerable to USN-2710-1.
Mitigation
Users of affected versions should apply the following mitigation:
- The Cloud Foundry project recommends that Cloud Foundry deployments run with BOSH stemcells 3048 or later versions, and cflinuxfs2 version 1.5.0 or later versions.
Credit
Moritz Jodeit and Jann Horn
