Arch Linux Security Advisory ASA-201612-20 ========================================== Severity: Medium Date : 2016-12-22 CVE-ID : CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 Package : openssh Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-110 Summary ======= The package openssh before version 7.4p1-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation, information disclosure and insufficient validation. Resolution ========== Upgrade to 7.4p1-1. # pacman -Syu "openssh>=7.4p1-1" The problems have been fixed upstream in version 7.4p1. Workaround ========== None. Description =========== - CVE-2016-10009 (arbitrary code execution) It was found that ssh-agent could load PKCS#11 modules from paths outside of a trusted whitelist. An attacker able to load a crafted PKCS#11 module across a forwarded agent channel could potentially use this flaw to execute arbitrary code on the system running the ssh- agent. Note that the attacker must have control of the forwarded agent- socket and the ability to write to the filesystem of the host running ssh-agent. - CVE-2016-10010 (privilege escalation) It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system. Privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in /etc/ssh/sshd_config. - CVE-2016-10011 (information disclosure) It was found that there is a theoretical leak of host private key material to privilege-separated child processes via realloc() when reading keys. No such leak was observed in practice for normal-sized keys, nor does a leak to the child processes directly expose key material to unprivileged users. - CVE-2016-10012 (insufficient validation) It was found that the shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimizing compilers. Additionally, this memory manager was incorrectly accessible when pre-authentication compression was disabled. This could potentially allow attacks against the privileged monitor process from the sandboxed privilege-separation process (a compromise of the latter would be required first). Impact ====== A remote attacker may be able to perform attacks against the shared memory manager used by pre-authentication compression support. Furthermore a local attacker may be able to execute arbitrary code and disclose sensitive information under certain circumstances or possibly escalate privileges when having privilege separation explicitly disabled. References ========== https://www.openssh.com/txt/release-7.4 http://seclists.org/oss-sec/2016/q4/708 http://seclists.org/oss-sec/2016/q4/705 https://access.redhat.com/security/cve/CVE-2016-10009 https://access.redhat.com/security/cve/CVE-2016-10010 https://access.redhat.com/security/cve/CVE-2016-10011 https://access.redhat.com/security/cve/CVE-2016-10012