Vulnerability Details : CVE-2008-1657
OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
Exploit prediction scoring system (EPSS) score for CVE-2008-1657
Probability of exploitation activity in the next 30 days: 0.45%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 72 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-1657
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
[email protected] |
CWE ids for CVE-2008-1657
-
Assigned by: [email protected] (Primary)
Vendor statements for CVE-2008-1657
-
Red Hat 2008-04-03Not vulnerable. These issues did not affect the versions of OpenSSH as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
-
http://www.vupen.com/english/advisories/2008/1035/references
Vendor Advisory
- http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
-
http://www.openssh.com/txt/release-4.9
Vendor Advisory
-
http://www.openbsd.org/errata43.html#001_openssh
Patch
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/41549
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc
-
http://www.vupen.com/english/advisories/2008/1624/references
Vendor Advisory
-
http://www.securityfocus.com/archive/1/490488/100/0/threaded
- http://aix.software.ibm.com/aix/efixes/security/ssh_advisory.asc
- http://support.attachmate.com/techdocs/2374.html
-
http://www.securityfocus.com/bid/28531
Patch
- http://www.ubuntu.com/usn/usn-649-1
-
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0139
-
http://www.vupen.com/english/advisories/2008/2396
Vendor Advisory
-
http://www.us-cert.gov/cas/techalerts/TA08-260A.html
US Government Resource
-
http://www.vupen.com/english/advisories/2008/2584
Vendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200804-03.xml
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:098
-
https://issues.rpath.com/browse/RPL-2419
-
http://www.securitytracker.com/id?1019733
- cpe:2.3:a:openbsd:openssh:4.5:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.6:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.4:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.4p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.7:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.8:*:*:*:*:*:*:*