SB20231201117 - Anolis OS update for openssh

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Double Free (CVE-ID: CVE-2023-25136)

The vulnerability allows a remote attacker to potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the sshd(8) daemon. A remote non-authenticated attacker can send  specially crafted data to the application, trigger a double free error and execute arbitrary code on the target system.

The vendor believes exploitation of this vulnerability has limitations as double free occurs "in the unprivileged pre-auth process that is subject to chroot(2) and is further sandboxed on most major platforms". Nevertheless we assign a high risk to this vulnerability.

2) Untrusted search path (CVE-ID: CVE-2023-38408)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of an insecure search path within the PKCS#11 feature in ssh-agent. A remote attacker can trick the victim into connecting to a malicious SSH server and execute arbitrary code on the system, if an agent is forwarded to an attacker-controlled system.

Note, this vulnerability exists due to incomplete fix for #VU2015 (CVE-2016-10009).

3) Improper input validation (CVE-ID: CVE-2016-10009)

The vulnerability allows a remote attacker to execute arbitrary code on vulnerable ssh client.

The vulnerability exists due to incorrect handling of data passed to PKCS#11 module within ssh-agent. A remote attacker with control over sshd service can execute arbitrary code on vulnerable client.

Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on vulnerable client system but requires that client is connected to malicious SSH server.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2023:0793