NVD

Id
27445  
Name
CVE-2015-6563  
Description
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.  
Reject
 
CVSS Version
2  
CVSS Score
1.9  
Severity
Low  
CVSS Base Score
1.9  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-08-23  
Modified Date
2016-12-21  
Seq
2015-6563  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
144141 27445 CVE-2015-6563 APPLE-SA-2015-10-21-4  View
144142 27445 CVE-2015-6563 FEDORA-2015-13469  View
144143 27445 CVE-2015-6563 SUSE-SU-2015:1581  View
144144 27445 CVE-2015-6563 20150813 BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities  View
144145 27445 CVE-2015-6563 http://www.openssh.com/txt/release-7.0  View
144146 27445 CVE-2015-6563 [oss-security] 20150821 Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities  View
144147 27445 CVE-2015-6563 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html  View
144148 27445 CVE-2015-6563 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html  View
144149 27445 CVE-2015-6563 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
144150 27445 CVE-2015-6563 76317  View
144151 27445 CVE-2015-6563 https://github.com/openssh/openssh-portable/commit/d4697fe9a28dab7255c60433e4dd23cf7fce8a8b  View
144152 27445 CVE-2015-6563 GLSA-201512-04  View
144153 27445 CVE-2015-6563 https://support.apple.com/HT205375  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9083 JVNDB-2015-004403 OpenBSD 以外のプラットフォーム上で稼働する OpenSSH の sshd のモニターコンポーネントにおけるなりすまし攻撃を実行される脆弱性 OpenBSD 以外のプラットフォーム上で稼働する OpenSSH の sshd のモニターコンポーネントは、MONITOR_REQ_PAM_INIT_CTX リクエストに外部からのユーザ名データを受け入れるため、なりすまし攻撃を実行される脆弱性が存在します。 CVE-2015-6563 83788 CVE-2015-6563 27445 1.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004403.html 2015-08-11 2015-10-27 View