OpenSSH is an implementation of the Secure Shell protocol. When OpenSSH is configured with the UseLogin directive equal to "yes", an intruder can execute arbitrary code with the privileges of OpenSSH, usually root.
OpenSSH contains a vulnerability that permits an intruder to execute arbitrary code. When the UseLogin directive is enabled, a user can set environment variables that are used by login. An intruder can use this vulnerability to execute commands with the privileges of OpenSSH, usually root. UseLogin is not enabled by default; however, it is a common configuration. The intruder must be able to authenticate to the system using public key authentication.
An intruder can use this vulnerability to execute commands with the privileges of OpenSSH, usually root.
OpenSSH 3.0.2 resolves this vulnerability and is available at <ftp://ftp.openbsd.com/pub/OpenBSD/OpenSSH/openssh-3.0.2.tgz>.
We strongly encourage you to review your configuration to determine whether or not _UseLogin _is enabled. If the use of UseLogin is required at your site, you may wish to temporarily disable access to the SSH service until a patch can be applied.
Vendor| Status| Date Notified| Date Updated
BSDI| | -| 10 Dec 2001
Caldera| | -| 17 Dec 2001
Debian| | -| 05 Dec 2001
FreeBSD| | -| 07 Dec 2001
IBM| | -| 04 Dec 2001
MandrakeSoft| | -| 14 Dec 2001
OpenBSD| | -| 04 Dec 2001
OpenSSH| | -| 04 Dec 2001
Red Hat| | -| 13 Dec 2001
SuSE| | -| 07 Dec 2001
Trustix| | -| 21 Dec 2001
F-Secure| | -| 11 Dec 2001
Fujitsu| | -| 11 Dec 2001
Hewlett Packard| | -| 13 Dec 2001
SSH Communications Security| | 07 Dec 2001| 12 Dec 2001
If you are a vendor and your product is affected, let us know.
Group | Score | Vector
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A
The CERT/CC thanks Marcus Friedl of OpenBSD, and Jacques A. Vidrine of FreeBSD for information related to this vulnerability.
This document was written by Jason Rafail.