CVE-2014-9278
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
AI Score
Confidence
Low
EPSS
Percentile
64.8%
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
Affected configurations
References
rhn.redhat.com/errata/RHSA-2015-0425.html
thread.gmane.org/gmane.comp.encryption.kerberos.general/15855
www.openwall.com/lists/oss-security/2014/12/02/3
www.openwall.com/lists/oss-security/2014/12/04/17
www.securityfocus.com/bid/71420
bugzilla.mindrot.org/show_bug.cgi?id=1867
bugzilla.redhat.com/show_bug.cgi?id=1169843
exchange.xforce.ibmcloud.com/vulnerabilities/99090
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
AI Score
Confidence
Low
EPSS
Percentile
64.8%