Improper Input Validation Affecting openssh package, versions <1:6.6p1-2ubuntu2.2


Severity

Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU1404-OPENSSH-368804
  • published24 Aug 2015
  • disclosed24 Aug 2015

Introduced: 24 Aug 2015

CVE-2015-6563  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade Ubuntu:14.04 openssh to version 1:6.6p1-2ubuntu2.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu. See How to fix? for Ubuntu:14.04 relevant fixed versions and status.

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.

CVSS Scores

version 3.1