NVD

Id
40140  
Name
CVE-2013-4548  
Description
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-11-08  
Modified Date
2015-11-20  
Seq
2013-4548  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
204265 40140 CVE-2013-4548 openSUSE-SU-2013:1726  View
204266 40140 CVE-2013-4548 SSRT101487  View
204267 40140 CVE-2013-4548 [oss-security] 20131107 Re: CVE Request - OpenSSH  View
204268 40140 CVE-2013-4548 http://www.openssh.com/txt/gcmrekey.adv  View
204269 40140 CVE-2013-4548 USN-2014-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23473 JVNDB-2013-005048 OpenSSH の sshd における ForceCommand およびログインシェルの制限を回避される脆弱性 OpenSSH の sshd の monitor_wrap.c 内の mm_newkeys_from_blob 関数は、AES-GCM 暗号化方式を使用する場合、MAC コンテキストデータ構造のメモリを適切に初期化しないため、ForceCommand およびログインシェルの制限を回避される脆弱性が存在します。 CVE-2013-4548 64490 CVE-2013-4548 40140 6 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005048.html 2013-11-07 2014-12-08 View