Vulnerability Details : CVE-2015-6564

Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
Publish Date : 2015-08-23 Last Update Date : 2018-09-11

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	6.9
Confidentiality Impact	Complete (There is total information disclosure, resulting in all system files being revealed.)
Integrity Impact	Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.)
Availability Impact	Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity	Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Gain privileges
CWE ID	264

- Related OVAL Definitions

Title	Definition Id	Class	Family
RHSA-2015:2088: openssh security, bug fix, and enhancement update (Moderate)	oval:com.redhat.rhsa:def:20152088		unix
RHSA-2016:0741: openssh security, bug fix, and enhancement update (Moderate)	oval:com.redhat.rhsa:def:20160741		unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2015-6564

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Openbsd	Openssh	6.9				Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Openbsd	Openssh	1

- References For CVE-2015-6564

https://security.gentoo.org/glsa/201512-04
GENTOO GLSA-201512-04

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html CONFIRM

http://www.openwall.com/lists/oss-security/2015/08/22/1
MLIST [oss-security] 20150821 Re: CVE request - OpenSSH 6.9 PAM privilege separation vulnerabilities

http://www.securityfocus.com/bid/76317
BID 76317 OpenSSH PAM Support Multiple Remote Code Execution Vulnerabilities Release Date:2017-12-05

https://github.com/openssh/openssh-portable/commit/5e75f5198769056089fb06c4d738ab0e5abc66f7 CONFIRM

https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
MLIST [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html CONFIRM

http://rhn.redhat.com/errata/RHSA-2016-0741.html
REDHAT RHSA-2016:0741

http://seclists.org/fulldisclosure/2015/Aug/54
FULLDISC 20150813 BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities

http://www.openssh.com/txt/release-7.0 CONFIRM

http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html
FEDORA FEDORA-2015-13469

https://kc.mcafee.com/corporate/index?page=content&id=SB10136 CONFIRM

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html
SUSE SUSE-SU-2015:1581

- Metasploit Modules Related To CVE-2015-6564

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)