diff options
Diffstat (limited to 'metadata/glsa/glsa-200703-13.xml')
-rw-r--r-- | metadata/glsa/glsa-200703-13.xml | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200703-13.xml b/metadata/glsa/glsa-200703-13.xml new file mode 100644 index 000000000000..c384ed34f406 --- /dev/null +++ b/metadata/glsa/glsa-200703-13.xml @@ -0,0 +1,68 @@ +<?xml version="1.0" encoding="utf-8"?> +<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> +<glsa id="200703-13"> + <title>SSH Communications Security's Secure Shell Server: SFTP privilege escalation</title> + <synopsis> + The SSH Secure Shell Server SFTP function is vulnerable to privilege + escalation. + </synopsis> + <product type="ebuild">net-misc/ssh</product> + <announced>2007-03-14</announced> + <revised>2007-03-14: 01</revised> + <bug>168584</bug> + <access>remote</access> + <affected> + <package name="net-misc/ssh" auto="yes" arch="*"> + <vulnerable range="lt">4.3.7</vulnerable> + </package> + </affected> + <background> + <p> + The SSH Secure Shell Server from SSH Communications Security + (www.ssh.com) is a commercial SSH implementation available free for + non-commercial use. + </p> + </background> + <description> + <p> + The SSH Secure Shell Server contains a format string vulnerability in + the SFTP code that handles file transfers (scp2 and sftp2). In some + situations, this code passes the accessed filename to the system log. + During this operation, an unspecified error could allow uncontrolled + stack access. + </p> + </description> + <impact type="normal"> + <p> + An authenticated system user may be able to exploit this vulnerability + to bypass command restrictions, or run commands as another user. + </p> + </impact> + <workaround> + <p> + There is no known workaround at this time. + </p> + </workaround> + <resolution> + <p> + This package is currently masked, there is no upgrade path for the + 3.2.x version, and a license must be purchased in order to update to a + non-vulnerable version. Because of this, we recommend unmerging this + package: + </p> + <code> + # emerge --ask --verbose --unmerge net-misc/ssh</code> + </resolution> + <references> + <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0705">CVE-2006-0705</uri> + </references> + <metadata tag="requester" timestamp="2007-03-05T21:03:07Z"> + vorlon + </metadata> + <metadata tag="bugReady" timestamp="2007-03-07T14:57:32Z"> + vorlon + </metadata> + <metadata tag="submitter" timestamp="2007-03-09T13:16:30Z"> + aetius + </metadata> +</glsa> |