CVE-2015-8325 — Incorrect Authorization in Openssh

CWE-264CWE-863 — Incorrect AuthorizationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer13 documents9 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 70.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Openbsd OpensshCanonical Ubuntu CoreCanonical Ubuntu Linux+3 more
Timeline
PublishedMay 1
Latest updateMay 14

Description

The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶Debianopenbsd/openssh< 1:7.2p2-3+3
▶Ubuntuopenbsd/openssh< 1:6.6p1-2ubuntu2.7
▶Palo Altopaloalto/pan-os

Also affects: Debian Linux 7.0, 8.0, Ubuntu Linux 12.04, 14.04, 15.10

🔴Vulnerability Details

4
GHSA
GHSA-729x-x825-x8jf: The do_setup_env function in session↗2022-05-14
▶
OSV
openssh vulnerabilities↗2016-05-09
▶
CVEList
CVE-2015-8325: The do_setup_env function in session↗2016-05-01
▶
OSV
CVE-2015-8325: The do_setup_env function in session↗2016-05-01
▶

📋Vendor Advisories

5
Palo Alto
PAN-SA-2020-0004 Informational: Third-party or open source vulnerabilities that do not affect PAN-OS↗2020-05-13
▶
Palo Alto
PAN-SA-2020-0005 PAN-OS: OpenSSH software upgraded to resolve multiple vulnerabilities↗2020-05-13
▶
Ubuntu
OpenSSH vulnerabilities↗2016-05-09
▶
Red Hat
openssh: privilege escalation via user's PAM environment and UseLogin=yes↗2016-04-13
▶
Debian
CVE-2015-8325: openssh - The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when th...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-8325 gsi-openssh: openssh: privilege escalation via user's PAM environment and UseLogin=yes [fedora-all]↗2016-04-19
▶
Bugzilla
CVE-2015-8325 openssh: privilege escalation via user's PAM environment and UseLogin=yes↗2016-04-18
▶
Bugzilla
CVE-2015-8325 openssh: ignore PAM environment vars when UseLogin=yes [fedora-all]↗2016-04-18
▶
CVE-2015-8325 — Incorrect Authorization in Openssh | cvebase