CVE

Id
64495  
CVE No.
CVE-2013-4548  
Status
Candidate  
Description
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
635697 64495 CVE-2013-4548 MLIST:[oss-security] 20131107 Re: CVE Request - OpenSSH  View
635698 64495 CVE-2013-4548 URL:http://openwall.com/lists/oss-security/2013/11/08/3  View
635699 64495 CVE-2013-4548 CONFIRM:http://www.openssh.com/txt/gcmrekey.adv  View
635700 64495 CVE-2013-4548 HP:HPSBUX03188  View
635701 64495 CVE-2013-4548 URL:http://marc.info/?l=bugtraq&m=141576985122836&w=2  View
635702 64495 CVE-2013-4548 HP:SSRT101487  View
635703 64495 CVE-2013-4548 URL:http://marc.info/?l=bugtraq&m=141576985122836&w=2  View
635704 64495 CVE-2013-4548 SUSE:openSUSE-SU-2013:1726  View
635705 64495 CVE-2013-4548 URL:http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00017.html  View
635706 64495 CVE-2013-4548 UBUNTU:USN-2014-1  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24143 JVNDB-2013-005718 Xen の XEN_DOMCTL_getmemlist hypercall におけるサービス運用妨害 (DoS) の脆弱性 Xen の XEN_DOMCTL_getmemlist hypercall は、page_alloc_lock および mm_rwlock を同じ順番で取得しないため、サービス運用妨害 (ホストデッドロック) 状態にされる脆弱性が存在します。 CVE-2013-4553 64495 5.2 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005718.html  View