CVE-2015-6563 — Improper Input Validation in Openssh

CWE-20 — Improper Input ValidationCWE-266 — Incorrect Privilege Assignment8 documents8 sources
Severity
1.9LOWNVD
EPSS
0.1%
top 72.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Openbsd OpensshApple MAC OS X
Timeline
PublishedAug 24
Latest updateMay 14

Description

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.

CVSS vector

AV:L/AC:M/C:N/I:P/A:NExploitability: 3.4 | Impact: 2.9

Affected Packages3 packages

▶Debianopenbsd/openssh< 1:6.9p1-1+3
▶NVDapple/mac_os_x10.11.0

🔴Vulnerability Details

3
GHSA
GHSA-2f6c-wrfr-f7rw: The monitor component in sshd in OpenSSH before 7↗2022-05-14
▶
OSV
CVE-2015-6563: The monitor component in sshd in OpenSSH before 7↗2015-08-24
▶
CVEList
CVE-2015-6563: The monitor component in sshd in OpenSSH before 7↗2015-08-24
▶

📋Vendor Advisories

3
Red Hat
openssh: Privilege separation weakness related to PAM support↗2015-08-11
▶
Debian
CVE-2015-6563: openssh - The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms acc...↗2015
▶
Apple
CVE-2015-6563: OS X El Capitan 10.11.1, Security Update 2015-004 Yosemite, and Security Update 2015-007 Mavericks↗
▶

💬Community

1
Bugzilla
CVE-2015-6563 openssh: Privilege separation weakness related to PAM support↗2015-08-12
▶
CVE-2015-6563 — Improper Input Validation in Openssh | cvebase