PRIOn knowledge basePRION:CVE-2014-9278Authentication flaw
6.6 Medium
AI Score
Confidence
Low
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
61.2%
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
References
rhn.redhat.com/errata/RHSA-2015-0425.html
thread.gmane.org/gmane.comp.encryption.kerberos.general/15855
www.openwall.com/lists/oss-security/2014/12/02/3
www.openwall.com/lists/oss-security/2014/12/04/17
www.securityfocus.com/bid/71420
bugzilla.mindrot.org/show_bug.cgi?id=1867
bugzilla.redhat.com/show_bug.cgi?id=1169843
exchange.xforce.ibmcloud.com/vulnerabilities/99090
Related
6.6 Medium
AI Score
Confidence
Low
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
61.2%