Multiple vulnerabilities in OpenSSH



Published: 2024-07-01 | Updated: 2024-08-16
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2024-6387
CVE-2024-39894
CVE-2024-6409
CWE-ID CWE-362
CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe 		OpenSSH
Server applications / Remote management servers, RDP, SSH

Vendor OpenSSH

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Race condition

EUVDB-ID: #VU93513

Risk: High

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2024-6387

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition in portable version of sshd. A remote non-authenticated attacker can send a series of requests in order to trigger a race condition and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSSH: 8.5p1 - 9.7p1

CPE2.3 External links

http://www.openssh.com/releasenotes.html#9.8p1
http://seclists.org/oss-sec/2024/q3/2


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Information disclosure

EUVDB-ID: #VU93514

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39894

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due a logic error in ObscureKeystrokeTiming implementation within the ssh client. A local user with ability to passively observe SSH sessions can recover sensitive input, such as password for the su or sudo programs.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSSH: 9.5p1 - 9.7p1

CPE2.3 External links

http://www.openssh.com/releasenotes.html#9.8p1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Race condition

EUVDB-ID: #VU94522

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-6409

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a race condition in portable version of sshd when handling signals. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. A remote non-authenticated attacker can send a series of requests in order to trigger a race condition and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSSH: 8.7p1 - 9.7p1

CPE2.3 External links

http://access.redhat.com/security/cve/CVE-2024-6409
http://bugzilla.redhat.com/show_bug.cgi?id=2295085
http://www.openwall.com/lists/oss-security/2024/07/08/2
http://explore.alas.aws.amazon.com/CVE-2024-6409.html
http://sig-security.rocky.page/issues/CVE-2024-6409/
http://ubuntu.com/security/CVE-2024-6409
http://security-tracker.debian.org/tracker/CVE-2024-6409
http://www.openwall.com/lists/oss-security/2024/07/09/2
http://www.openwall.com/lists/oss-security/2024/07/09/5
http://bugzilla.suse.com/show_bug.cgi?id=1227217
http://www.suse.com/security/cve/CVE-2024-6409.html
http://almalinux.org/blog/2024-07-09-cve-2024-6409/
http://www.openwall.com/lists/oss-security/2024/07/10/1
http://www.openwall.com/lists/oss-security/2024/07/10/2
http://github.com/openela-main/openssh/commit/c00da7741d42029e49047dd89e266d91dcfbffa0
http://security.netapp.com/advisory/ntap-20240712-0003/
http://access.redhat.com/errata/RHSA-2024:4457


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###