CVE-2007-4752

2007-09-1200:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.021 Low

EPSS

Percentile

89.0%

JSON

ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie
cannot be created and uses a trusted X11 cookie instead, which allows
attackers to violate intended policy and gain privileges by causing an X
client to be treated as trusted.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/162171>

Notes

Author	Note
jdstrand	from secure-testing: An exploit needs limited control over the machine running a trusted X client, so this is only a slight privilege escalation. The X Security extension is merely an afterthought and is unlikely to provide strong security guarantees.

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchopenssh< 1:4.2p1-7ubuntu3.2UNKNOWN
ubuntu6.10noarchopenssh< 1:4.3p2-5ubuntu1.1UNKNOWN
ubuntu7.04noarchopenssh< 1:4.3p2-8ubuntu1.1UNKNOWN
ubuntu7.10noarchopenssh< 1:4.6p1-5ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	openssh	< 1:4.2p1-7ubuntu3.2	UNKNOWN
ubuntu	6.10	noarch	openssh	< 1:4.3p2-5ubuntu1.1	UNKNOWN
ubuntu	7.04	noarch	openssh	< 1:4.3p2-8ubuntu1.1	UNKNOWN
ubuntu	7.10	noarch	openssh	< 1:4.6p1-5ubuntu0.1	UNKNOWN