{"vuid":"VU#740619","idnumber":"740619","name":"SSH Secure Shell for Servers fails to remove child process from master process group","keywords":["SSH Secure Shell","setsid() function","DSA key","setlogin() function"],"overview":"A locally exploitable privilege escalation vulnerability exists in SSH Secure Shell versions 2.0.13 - 3.2.1.","clean_desc":"Secure Shell for Servers, developed by SSH Communications Security, does not properly remove the child process from the master process group after non-interactive command execution. Quoting from the SSH Communications Security Advisory: When used in non-interactive connections, a defect in process grouping\nof SSH Secure Shell processes may allow malicious activity. If\nexecuting a command without a pty (including running commands and\nsubsystems) the child process remains in the process group of the\nmaster process. On platforms relying on getlogin() (mainly the different BSD variants)\nmalicious users can at least send misleading messages to syslog and\nothers applications (getlogin() call will return \"root\"). For more details, please see the SSH Communications Security Advisory.","impact":"A local attacker may be able to gain elevated privileges.","resolution":"Upgrade your software. Note that both Secure Shell for Servers and Secure Shell for Workstations need to be updated to eliminate this vulnerability.","workarounds":"","sysaffected":"","thanks":"Thanks to Logan Gabriel for reporting this vulnerability.","author":"This document was written by Ian A Finlay.","public":["h","t","t","p",":","/","/","w","w","w",".","s","s","h",".","c","o","m","/","c","o","m","p","a","n","y","/","n","e","w","s","r","o","o","m","/","a","r","t","i","c","l","e","/","2","8","6","/"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-08-20T15:26:35Z","publicdate":"2002-11-25T00:00:00Z","datefirstpublished":"2002-11-25T17:14:18Z","dateupdated":"2008-05-29T21:58:13Z","revision":16,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"2","cam_widelyknown":"1","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"15","cam_impact":"18","cam_easeofexploitation":"15","cam_attackeraccessrequired":"10","cam_scorecurrent":"8.353125","cam_scorecurrentwidelyknown":"22.78125","cam_scorecurrentwidelyknownexploited":"37.96875","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":8.353125,"vulnote":null}