CVE-2013-4259
published 2013-09-16CVE-2013-4259: runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a…
PriorityP45low1.9CVSS 2.0
AVLACMAuNCPINAN
EPSS
0.34%
26.1th percentile
runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 1.3.4+dfsg-1 (bookworm) | ansible 1.3.4+dfsg-1 (bookworm) |
| redhat | ansible | <= 1.2.2 | — |
| redhat | ansible | >= 0 < 1.3.4+dfsg-1 | 1.3.4+dfsg-1 |
| redhat | ansible | >= 0 < 1.3.4+dfsg-1 | 1.3.4+dfsg-1 |
| redhat | ansible | >= 0 < 1.3.4+dfsg-1 | 1.3.4+dfsg-1 |
| redhat | ansible | >= 0 < 1.3.4+dfsg-1 | 1.3.4+dfsg-1 |
| redhat | ansible | >= 0 < 1.2.3 | 1.2.3 |
CVSS provenance
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv1.9LOW
vendor_debian1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Ansible uses a socket with predictable filename in /tmp
osv·2022-05-14
CVE-2013-4259 [LOW] Ansible uses a socket with predictable filename in /tmp
Ansible uses a socket with predictable filename in /tmp
`runner/connection_plugins/ssh.py` in Ansible before 1.2.3, when using `ControlPersist`, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in `/tmp/`.
GHSA
Ansible uses a socket with predictable filename in /tmp
ghsa·2022-05-14
CVE-2013-4259 [LOW] CWE-330 Ansible uses a socket with predictable filename in /tmp
Ansible uses a socket with predictable filename in /tmp
`runner/connection_plugins/ssh.py` in Ansible before 1.2.3, when using `ControlPersist`, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in `/tmp/`.
OSV
CVE-2013-4259: runner/connection_plugins/ssh
osv·2013-09-16·CVSS 1.9
CVE-2013-4259 [LOW] CVE-2013-4259: runner/connection_plugins/ssh
runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
Debian
CVE-2013-4259: ansible - runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPers...
vendor_debian·2013·CVSS 1.9
CVE-2013-4259 [LOW] CVE-2013-4259: ansible - runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPers...
runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
Scope: local
bookworm: resolved (fixed in 1.3.4+dfsg-1)
bullseye: resolved (fixed in 1.3.4+dfsg-1)
forky: resolved (fixed in 1.3.4+dfsg-1)
sid: resolved (fixed in 1.3.4+dfsg-1)
trixie: resolved (fixed in 1.3.4+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4259 ansible: insecure location for ssh ControlMaster socket [epel-6]
bugzilla·2013-08-27·CVSS 1.9
CVE-2013-4259 [LOW] CVE-2013-4259 ansible: insecure location for ssh ControlMaster socket [epel-6]
CVE-2013-4259 ansible: insecure location for ssh ControlMaster socket [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
epel-6 tracking bug f
Bugzilla
CVE-2013-4259 CVE-2013-4260 ansible: various flaws [fedora-all]
bugzilla·2013-08-21·CVSS 1.9
CVE-2013-4259 [LOW] CVE-2013-4259 CVE-2013-4260 ansible: various flaws [fedora-all]
CVE-2013-4259 CVE-2013-4260 ansible: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multiple
Bugzilla
CVE-2013-4259 ansible: insecure location for ssh ControlMaster socket
bugzilla·2013-08-18·CVSS 1.9
CVE-2013-4259 [LOW] CVE-2013-4259 ansible: insecure location for ssh ControlMaster socket
CVE-2013-4259 ansible: insecure location for ssh ControlMaster socket
by default, ansible try to create a ControlMaster file in a predictible location in /tmp. This is vulnerable to a ssh socket injection attack like this :
~ $ sudo ln -s /tmp/ansible-ssh-elspeth.example.org-22-misc /tmp/ansible-ssh-sisay.example.org-22-misc
~ $ ansible -i 'elspeth.example.org,sisay.example.org' all -m shell -u misc -a hostname
elspeth.example.org | success | rc=0 >>
elspeth.example.org
sisay.example.org | success | rc=0 >>
elspeth.example.org
I also did a test without using root, that's the same.
Based on this attack, someone could divert the ssh connexion to another server, make it connect to a server under the control of attacker, and steal configuration file ( with passwords ), or steal password
http://www.ansible.com/securityhttps://bugzilla.redhat.com/show_bug.cgi?id=998223https://groups.google.com/forum/#%21topic/ansible-project/UVDYW0HGcNghttp://www.ansible.com/securityhttps://bugzilla.redhat.com/show_bug.cgi?id=998223https://groups.google.com/forum/#%21topic/ansible-project/UVDYW0HGcNg
2013-09-16
Published