OpenSSH UseLogin option allows remote execution of commands as root

Overview

Versions of OpenSSH prior to 2.1.1 (current circa June, 2000) allow a remote attacker to execute arbitrary commands with the privileges of sshd, typically root.

Description

OpenSSH is a free implementation of versions 1 and 2 of the SSH protocol. If sshd is configured with the UseLogin option, it attempts to use login(1) to authenticate the user. However, is ssh is used to execute a command, the command is run with the privileges of sshd, typically root. UseLogin is not enabled by default.

---

Impact

Remote attackers can run arbitrary commands as root on systems with UseLogin enabled.

---

Solution

Upgrade to the latest version of OpenSSH.

---

Vendor Information

40327

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

OpenSSH __ Affected

Updated: November 05, 2001

Status

Affected

Vendor Statement

See <http://www.openbsd.org/errata27.html#uselogin&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%2340327 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.openbsd.org/errata27.html#uselogin&gt;
• <http://www.securityfocus.com/bid/1334&gt;
• http://www.securityfocus.com/templates/archive.pike?list=1&date=2000-06-8&[email protected]
• <http://www.ciac.org/ciac/bulletins/k-058.shtml&gt;
• <http://www.securiteam.com/unixfocus/5MQ070A1QU.html&gt;
• <http://xforce.iss.net/alerts/vol-5_num-6.php#-openssh-uselogin-remote-exec&gt;

Acknowledgements

Our thanks to Markus Friedl who reported this information.

This document was written by Shawn V Hernan.

Other Information

CVE IDs:	CVE-2000-0525
Severity Metric:	31.50 Date Public: