UBUNTU-CVE-2015-6563

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2015-6563

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-6563.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2015-6563

Related

Published

2015-08-24T01:59:00Z

Modified

2015-08-24T01:59:00Z

Summary

[none]

Details

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITORREQPAMINITCTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITORREQPWNAM request, related to monitor.c and monitor_wrap.c.

References

Affected packages

Ubuntu:14.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh@1:6.6p1-2ubuntu2.2?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:6.6p1-2ubuntu2.2

Affected versions

1:6.*

1:6.2p2-6

1:6.2p2-6ubuntu1

1:6.4p1-1

1:6.4p1-2

1:6.5p1-1

1:6.5p1-2

1:6.5p1-3

1:6.5p1-4

1:6.5p1-6

1:6.6p1-1

1:6.6p1-2

1:6.6p1-2ubuntu1

1:6.6p1-2ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "ssh-askpass-gnome": "1:6.6p1-2ubuntu2.2",
            "ssh-askpass-gnome-dbgsym": "1:6.6p1-2ubuntu2.2",
            "openssh-client-udeb-dbgsym": "1:6.6p1-2ubuntu2.2",
            "openssh-client-udeb": "1:6.6p1-2ubuntu2.2",
            "ssh-krb5": "1:6.6p1-2ubuntu2.2",
            "openssh-server-udeb-dbgsym": "1:6.6p1-2ubuntu2.2",
            "openssh-sftp-server": "1:6.6p1-2ubuntu2.2",
            "openssh-sftp-server-dbgsym": "1:6.6p1-2ubuntu2.2",
            "openssh-client": "1:6.6p1-2ubuntu2.2",
            "openssh-server": "1:6.6p1-2ubuntu2.2",
            "openssh-server-udeb": "1:6.6p1-2ubuntu2.2",
            "openssh-server-dbgsym": "1:6.6p1-2ubuntu2.2",
            "ssh": "1:6.6p1-2ubuntu2.2",
            "openssh-client-dbgsym": "1:6.6p1-2ubuntu2.2"
        }
    ]
}