CVE-2015-8325
published 2016-05-01CVE-2015-8325: The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.63%
45.8th percentile
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_core | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_touch | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openssh | < openssh 1:7.2p2-3 (bookworm) | openssh 1:7.2p2-3 (bookworm) |
| openbsd | openssh | <= 7.2 | — |
| openbsd | openssh | >= 0 < 1:7.2p2-3 | 1:7.2p2-3 |
| openbsd | openssh | >= 0 < 1:7.2p2-3 | 1:7.2p2-3 |
| openbsd | openssh | >= 0 < 1:7.2p2-3 | 1:7.2p2-3 |
| openbsd | openssh | >= 0 < 1:7.2p2-3 | 1:7.2p2-3 |
| openbsd | openssh | >= 0 < 1:6.6p1-2ubuntu2.7 | 1:6.6p1-2ubuntu2.7 |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices
cisa_ics·2022-12-19
Siemens SCALANCE X-200RNA Switch Devices
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X-200RNA Switch Devices
Last RevisedDecember 19, 2022
Alert CodeICSA-22-349-21
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available
- Vendor: Siemens
- Equipment: SCALANCE X-200RNA switch devices before V3.2.7
- Vulnerabilities: Observable Timing Discrepancy; Race Condition; Improper Restriction of Operations within the Bounds of a Memory Buffer; Improper Input Validation; NULL Pointer Dereference; Use After Free; Cryptographic Issues; Comparison of Incompatible Types; Resource Management
Palo Alto
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
vendor_paloalto·2020-05-13·CVSS 7.5
CVE-2014-1692 [HIGH] PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS
Palo Alto Networks Product Security Assurance team has evaluated and determined that these third-party or open source vulnerabilities do not have a security impact on PAN-OS, or the scenarios required for successful
CVEs: CVE-2014-1692, CVE-2014-2532, CVE-2014-2653, CVE-2015-5352, CVE-2015-8325, CVE-2016-10009, CVE-2016-10010, CVE-2016-10708, CVE-2016-1908, CVE-2016-3115, CVE-2016-6515, CVE-2018-15473, CVE-2018-15919
Affected products: PAN-OS
Palo Alto
PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
vendor_paloalto·2020-05-13·CVSS 7.8
CVE-2016-10012 [HIGH] CWE-119 PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities
OpenSSH software included with PAN-OS has been upgraded to resolve security vulnerability CVE-2016-10012. Additionally, code changes have been made to the server component of the OpenSSH software included in PAN-OS in response to CVE-2015-8325 and CVE-2016-1908 though PAN-OS is not impacted by these issues. This issues affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.1; All versions of PAN-OS 8.0. CVE CVSS Summary CVE-2016-10012 7.8 ( CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ) The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enf
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 7.8
CVE-2015-8325 [HIGH] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Shayan Sadigh discovered that OpenSSH incorrectly handled environment files
when the UseLogin feature is enabled. A local attacker could use this issue
to gain privileges. (CVE-2015-8325)
Ben Hawkes discovered that OpenSSH incorrectly handled certain network
traffic. A remote attacker could possibly use this issue to cause OpenSSH
to crash, resulting in a denial of service. This issue only applied to
Ubuntu 15.10. (CVE-2016-1907)
Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11
forwarding when the SECURITY extension is disabled. A connection configured
as being untrusted could get switched to trusted in certain scenarios,
contrary to expectations. (CVE-2016-1908)
It was discove
Red Hat
openssh: privilege escalation via user's PAM environment and UseLogin=yes
vendor_redhat·2016-04-13·CVSS 7.8
CVE-2015-8325 [HIGH] CWE-863 openssh: privilege escalation via user's PAM environment and UseLogin=yes
openssh: privilege escalation via user's PAM environment and UseLogin=yes
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root.
Package: openssh (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2015-8325: openssh - The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when th...
vendor_debian·2015·CVSS 7.8
CVE-2015-8325 [HIGH] CVE-2015-8325: openssh - The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when th...
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
Scope: local
bookworm: resolved (fixed in 1:7.2p2-3)
bullseye: resolved (fixed in 1:7.2p2-3)
forky: resolved (fixed in 1:7.2p2-3)
sid: resolved (fixed in 1:7.2p2-3)
trixie: resolved (fixed in 1:7.2p2-3)
GHSA
GHSA-729x-x825-x8jf: The do_setup_env function in session
ghsa_unreviewed·2022-05-14
CVE-2015-8325 [HIGH] GHSA-729x-x825-x8jf: The do_setup_env function in session
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
OSV
openssh vulnerabilities
osv·2016-05-09·CVSS 7.8
CVE-2015-8325 [HIGH] openssh vulnerabilities
openssh vulnerabilities
Shayan Sadigh discovered that OpenSSH incorrectly handled environment files
when the UseLogin feature is enabled. A local attacker could use this issue
to gain privileges. (CVE-2015-8325)
Ben Hawkes discovered that OpenSSH incorrectly handled certain network
traffic. A remote attacker could possibly use this issue to cause OpenSSH
to crash, resulting in a denial of service. This issue only applied to
Ubuntu 15.10. (CVE-2016-1907)
Thomas Hoger discovered that OpenSSH incorrectly handled untrusted X11
forwarding when the SECURITY extension is disabled. A connection configured
as being untrusted could get switched to trusted in certain scenarios,
contrary to expectations. (CVE-2016-1908)
It was discovered that OpenSSH incorrectly handled certain X11 forwarding
data
OSV
CVE-2015-8325: The do_setup_env function in session
osv·2016-05-01·CVSS 7.8
CVE-2015-8325 [HIGH] CVE-2015-8325: The do_setup_env function in session
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-8325 gsi-openssh: openssh: privilege escalation via user's PAM environment and UseLogin=yes [fedora-all]
bugzilla·2016-04-19·CVSS 7.8
CVE-2015-8325 [HIGH] CVE-2015-8325 gsi-openssh: openssh: privilege escalation via user's PAM environment and UseLogin=yes [fedora-all]
CVE-2015-8325 gsi-openssh: openssh: privilege escalation via user's PAM environment and UseLogin=yes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue aff
Bugzilla
CVE-2015-8325 openssh: privilege escalation via user's PAM environment and UseLogin=yes
bugzilla·2016-04-18·CVSS 7.8
CVE-2015-8325 [HIGH] CVE-2015-8325 openssh: privilege escalation via user's PAM environment and UseLogin=yes
CVE-2015-8325 openssh: privilege escalation via user's PAM environment and UseLogin=yes
If PAM is configured to read user-specified environment variables and UseLogin=yes in sshd_config, then a hostile local user may attack /bin/login via LD_PRELOAD or similar environment variables set via PAM.
Upstream fix:
https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
Debian advisory:
https://www.debian.org/security/2016/dsa-3550
Discussion:
Created openssh tracking bugs for this issue:
Affects: fedora-all [bug 1328013]
---
The impact is minimal.
1. The user_readenv is off by default in pam_env module.
2. UseLogin is set to no by default and in general there is not much sense in setting it to yes.
The question is whether the 'UseLogin yes' should
Bugzilla
CVE-2015-8325 openssh: ignore PAM environment vars when UseLogin=yes [fedora-all]
bugzilla·2016-04-18·CVSS 7.8
CVE-2015-8325 [HIGH] CVE-2015-8325 openssh: ignore PAM environment vars when UseLogin=yes [fedora-all]
CVE-2015-8325 openssh: ignore PAM environment vars when UseLogin=yes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
http://rhn.redhat.com/errata/RHSA-2016-2588.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0641.htmlhttp://www.debian.org/security/2016/dsa-3550http://www.securityfocus.com/bid/86187http://www.securitytracker.com/id/1036487https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755https://bugzilla.redhat.com/show_bug.cgi?id=1328012https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8325.htmlhttps://security-tracker.debian.org/tracker/CVE-2015-8325https://security.gentoo.org/glsa/201612-18https://security.netapp.com/advisory/ntap-20180628-0001/http://rhn.redhat.com/errata/RHSA-2016-2588.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0641.htmlhttp://www.debian.org/security/2016/dsa-3550http://www.securityfocus.com/bid/86187http://www.securitytracker.com/id/1036487https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755https://bugzilla.redhat.com/show_bug.cgi?id=1328012https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8325.htmlhttps://security-tracker.debian.org/tracker/CVE-2015-8325https://security.gentoo.org/glsa/201612-18https://security.netapp.com/advisory/ntap-20180628-0001/
2016-05-01
Published