OpenSSH UseLogin环境变量传递漏洞

漏洞信息详情

OpenSSH UseLogin环境变量传递漏洞

• CNNVD编号：CNNVD-200112-123
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2001-0872
  
• 漏洞类型：
  
  
  输入验证
  
• 发布时间：
  
  2001-12-21
  
• 威胁类型：
  
  
  本地
  
• 更新时间：
  
  2006-03-28
  
• 厂        商：
  
  suse
• 漏洞来源：
  This vulnerability…

OpenSSH 3.0.1及其早期版本存在漏洞。当UseLogin有效时，该软件不能正确的净化关键环境变量如：D_PRELOAD，本地用户利用该漏洞提升根特权。

Update available:
OpenBSD OpenSSH 1.2.3

• Debian 2.2 alpha ssh-askpass-gnome_1.2.3-9.4_alpha.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-
  askpass-gnome_1.2.3-9.4_alpha.deb
• Debian 2.2 alpha ssh_1.2.3-9.4_alpha.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_
  1.2.3-9.4_alpha.deb
• Debian 2.2 arm ssh-askpass-gnome_1.2.3-9.4_arm.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-arm/ssh-as
  kpass-gnome_1.2.3-9.4_arm.deb
• Debian 2.2 arm ssh_1.2.3-9.4_arm.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-arm/ssh_1.
  2.3-9.4_arm.deb
• Debian 2.2 i386 ssh-askpass-gnome_1.2.3-9.4_i386.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-a
  skpass-gnome_1.2.3-9.4_i386.deb
• Debian 2.2 i386 ssh_1.2.3-9.4_i386.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1
  .2.3-9.4_i386.deb
• Debian 2.2 m68k ssh-askpass-gnome_1.2.3-9.4_m68k.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-a
  skpass-gnome_1.2.3-9.4_m68k.deb
• Debian 2.2 m68k ssh_1.2.3-9.4_m68k.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1
  .2.3-9.4_m68k.deb
• Debian 2.2 ppc ssh-askpass-gnome_1.2.3-9.4_powerpc.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/ss
  h-askpass-gnome_1.2.3-9.4_powerpc.deb
• Debian 2.2 ppc ssh_1.2.3-9.4_powerpc.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/ss
  h_1.2.3-9.4_powerpc.deb
• Debian 2.2 sparc ssh-askpass-gnome_1.2.3-9.4_sparc.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-
  askpass-gnome_1.2.3-9.4_sparc.deb
• Debian 2.2 sparc ssh_1.2.3-9.4_sparc.deb
  
  http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_
  1.2.3-9.4_sparc.deb

OpenBSD OpenSSH 2.1.1 p1

• Trustix 1.1 i386 openssh-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssh-3.0.2p1-2tr
  .i586.rpm
• Trustix 1.1 i386 openssh-clients-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssh-clients-3.0
  .2p1-2tr.i586.rpm
• Trustix 1.1 i386 openssh-server-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/openssh-server-3.0.
  2p1-2tr.i586.rpm
• Trustix 1.2 i386 openssh-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssh-3.0.2p1-2tr
  .i586.rpm
• Trustix 1.2 i386 openssh-clients-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssh-clients-3.0
  .2p1-2tr.i586.rpm
• Trustix 1.2 i386 openssh-server-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/openssh-server-3.0.
  2p1-2tr.i586.rpm
• Trustix 1.5 i386 openssh-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssh-3.0.2p1-2tr
  .i586.rpm
• Trustix 1.5 i386 openssh-clients-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssh-clients-3.0
  .2p1-2tr.i586.rpm
• Trustix 1.5 i386 openssh-server-3.0.2p1-2tr.i586.rpm
  ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/openssh-server-3.0.
  2p1-2tr.i586.rpm

OpenBSD OpenSSH 2.9 p2

• Caldera OpenLinux 3.1 Server openssh-2.9p2-4.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/op
  enssh-2.9p2-4.i386.rpm
• Caldera OpenLinux 3.1 Server openssh-askpass-2.9p2-4.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/op
  enssh-askpass-2.9p2-4.i386.rpm
• Caldera OpenLinux 3.1 Server openssh-server-2.9p2-4.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/op
  enssh-server-2.9p2-4.i386.rpm
• Caldera OpenLinux 3.1 Workstation openssh-2.9p2-4.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP
  MS/openssh-2.9p2-4.i386.rpm
• Caldera OpenLinux 3.1 Workstation openssh-askpass-2.9p2-4.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP
  MS/openssh-askpass-2.9p2-4.i386.rpm
• Caldera OpenLinux 3.1 Workstation openssh-server-2.9p2-4.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP
  MS/openssh-server-2.9p2-4.i386.rpm
• Red Hat 7.0 alpha openssh-2.9p2-11.7.alpha.rpm
  ftp://updates.redhat.com/7.0/en/os/alpha/openssh-2.9p2-11.7.alpha.rpm
• Red Hat 7.0 alpha openssh-askpass-2.9p2-11.7.alpha.rpm
  ftp://updates.redhat.com