high7.0Public exploit code
CVE-2016-10010
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privile…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation2016-12-23 · local · linux · Verified
Impact
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openbsd | Openssh | through 7.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/140262/OpenSSH-Local-Privilege-Escalation.html
- http://www.openwall.com/lists/oss-security/2016/12/19/2
- http://www.securityfocus.com/bid/94972
- http://www.securitytracker.com/id/1037490
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1010
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc
- https://security.netapp.com/advisory/ntap-20171130-0002/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- https://www.exploit-db.com/exploits/40962/
- https://www.openssh.com/txt/release-7.4
- http://packetstormsecurity.com/files/140262/OpenSSH-Local-Privilege-Escalation.html
- http://www.openwall.com/lists/oss-security/2016/12/19/2
- http://www.securityfocus.com/bid/94972
- http://www.securitytracker.com/id/1037490
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1010
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc
- https://security.netapp.com/advisory/ntap-20171130-0002/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- https://www.exploit-db.com/exploits/40962/