New OpenSSH Vulnerability Exposes Linux Systems to Remote Command Injection

Particulars have emerged about a now-patched flaw in OpenSSH that could be likely exploited to operate arbitrary instructions remotely on compromised hosts underneath unique ailments.

“This vulnerability makes it possible for a remote attacker to possibly execute arbitrary instructions on susceptible OpenSSH’s forwarded ssh-agent,” Saeed Abbasi, supervisor of vulnerability study at Qualys, mentioned in an assessment previous week.

The vulnerability is remaining tracked beneath the CVE identifier CVE-2023-38408 (CVSS score: N/A). It impacts all versions of OpenSSH right before 9.3p2.

OpenSSH is a common connectivity device for distant login with the SSH protocol which is employed for encrypting all visitors to reduce eavesdropping, relationship hijacking, and other attacks.

Prosperous exploitation involves the existence of selected libraries on the target technique and that the SSH authentication agent is forwarded to an attacker-controlled method. SSH agent is a qualifications method that maintains users’ keys in memory and facilitates remote logins to a server without getting to enter their passphrase once again.

“When browsing via ssh-agent’s source code, we recognized that a remote attacker, who has entry to the remote server wherever Alice’s ssh-agent is forwarded to, can load (dlopen()) and quickly unload (dlclose()) any shared library in /usr/lib* on Alice’s workstation (by way of her forwarded ssh-agent, if it is compiled with Help_PKCS11, which is the default),” Qualys explained.

The cybersecurity firm claimed it was in a position to devise a successful proof-of-concept (PoC) from default installations of Ubuntu Desktop 22.04 and 21.10, while other Linux distributions are expected to be susceptible as well.

Upcoming WEBINARShield Against Insider Threats: Grasp SaaS Security Posture Management

Worried about insider threats? We have acquired you covered! Be a part of this webinar to discover realistic strategies and the secrets of proactive security with SaaS Security Posture Administration.

Be a part of Now

It is strongly suggested that buyers of OpenSSH update to the most recent variation in order to safeguard in opposition to probable cyber threats.

Previously this February, OpenSSH maintainers introduced an update to remediate a medium-severity security flaw (CVE-2023-25136, CVSS rating: 6.5) that could be exploited by an unauthenticated remote attacker to modify unanticipated memory destinations and theoretically reach code execution.

Found this short article intriguing? Adhere to us on Twitter  and LinkedIn to study extra unique content we publish.

Some sections of this posting are sourced from:
thehackernews.com