Vulnerability Name:

CVE-2001-0872 (CCN-7647)

Assigned:2001-12-04
Published:2001-12-04
Updated:2018-05-03
Summary:OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges.
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: CALDERA
Type: UNKNOWN
CSSA-2001-042.1

Source: CCN
Type: Caldera International, Inc. Security Advisory CSSA-2001-042.1
Linux - Local vulnerability in OpenSSH

Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-01:63
OpenSSH UseLogin directive permits privilege escalation

Source: MITRE
Type: CNA
CVE-2001-0872

Source: CONECTIVA
Type: UNKNOWN
CLA-2001:446

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2001:092

Source: SUSE
Type: Patch, Vendor Advisory
SuSE-SA:2001:045

Source: BUGTRAQ
Type: UNKNOWN
20011204 [Fwd: OpenSSH 3.0.2 fixes UseLogin vulnerability]

Source: CONFIRM
Type: UNKNOWN
http://marc.info/?l=openssh-unix-dev&m=100747128105913&w=2

Source: CCN
Type: openssh-unix-dev Mailing List, 2001-12-04 12:48:19
OpenSSH 3.0.2 fixes UseLogin vulnerability

Source: CCN
Type: Vuln-Dev Mailing List, 2001-12-06 0:34:34
OpenSSH UseLogin proof of concept exploit

Source: CCN
Type: Hewlett-Packard Company Security Bulletin HPSBTL0112-005
Security vulnerability in OpenSSH

Source: CCN
Type: RHSA-2001-161
Updated OpenSSH packages available

Source: CCN
Type: CIAC Information Bulletin M-026
OpenSSH UseLogin Privilege Elevation Vulnerability

Source: CIAC
Type: UNKNOWN
M-026

Source: DEBIAN
Type: UNKNOWN
DSA-091

Source: DEBIAN
Type: DSA-091
ssh -- influencing login

Source: CCN
Type: US-CERT VU#157447
OpenSSH UseLogin directive permits privilege escalation

Source: CERT-VN
Type: US Government Resource
VU#157447

Source: CCN
Type: OpenSSH Web site
OpenSSH

Source: OSVDB
Type: UNKNOWN
688

Source: CCN
Type: OSVDB ID: 688
OpenSSH UseLogin Environment Variable Local Command Execution

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2001:161

Source: BID
Type: UNKNOWN
3614

Source: CCN
Type: BID-3614
OpenSSH UseLogin Environment Variable Passing Vulnerability

Source: CCN
Type: SuSE Security Announcement SuSE-SA:2001:045
openssh

Source: CCN
Type: Trustix Secure Linux Security Advisory #2001-0030
OpenSSH

Source: HP
Type: UNKNOWN
HPSBUX0112-005

Source: XF
Type: UNKNOWN
openssh-uselogin-execute-code(7647)

Source: XF
Type: UNKNOWN
openssh-uselogin-execute-code(7647)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openbsd:openssh:*:*:*:*:*:*:*:* (Version <= 3.0.1)

    • Configuration 2:
  • cpe:/o:redhat:linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:6.4:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.3:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:openbsd:openbsd:2.6:*:*:*:*:*:*:*
  • OR cpe:/o:openbsd:openbsd:2.7:*:*:*:*:*:*:*
  • OR cpe:/o:openbsd:openbsd:2.8:*:*:*:*:*:*:*
  • OR cpe:/o:openbsd:openbsd:2.9:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.1.1:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.5.2:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.5.1:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.9:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:3.0:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.9.9p2:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:3.0p1:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:3.0.1p1:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:3.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.3:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.9p2:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.9p1:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.9.9:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:1.2.2:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:1.2.3:-:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:1.2.27:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:1.2:*:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.1.1:p4:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.2.0:p1:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.3.0:p1:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.5.1:p1:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.5.1:p2:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.5.2:p2:*:*:*:*:*:*
  • OR cpe:/a:openbsd:openssh:2.9.9:p1:*:*:*:*:*:*
  • AND
  • cpe:/o:suse:suse_linux:6.4:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.01:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_single_network_firewall:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:4.3:-:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.5:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:hp:secure_os:1.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:4.4:-:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.debian:def:91
    V
    		influencing login
    2001-12-05
    BACK
    openbsd openssh *
    redhat linux 7.0
    redhat linux 7.1
    redhat linux 7.2
    suse suse linux 6.4
    suse suse linux 7.0
    suse suse linux 7.1
    suse suse linux 7.2
    suse suse linux 7.3
    openbsd openbsd 2.6
    openbsd openbsd 2.7
    openbsd openbsd 2.8
    openbsd openbsd 2.9
    openbsd openssh 2.1.1
    openbsd openssh 2.5.2
    openbsd openssh 2.5
    openbsd openssh 2.5.1
    openbsd openssh 2.9
    openbsd openssh 3.0
    openbsd openssh 2.9.9p2
    openbsd openssh 3.0p1
    openbsd openssh 3.0.1p1
    openbsd openssh 3.0.1
    openbsd openssh 2.1
    openbsd openssh 2.2
    openbsd openssh 2.3
    openbsd openssh 2.9p2
    openbsd openssh 2.9p1
    openbsd openssh 2.9.9
    openbsd openssh 1.2.2
    openbsd openssh 1.2.3
    openbsd openssh 1.2.27
    openbsd openssh 1.2.1
    openbsd openssh 1.2
    openbsd openssh 2.1.1 p4
    openbsd openssh 2.2.0 p1
    openbsd openssh 2.3.0 p1
    openbsd openssh 2.5.1 p1
    openbsd openssh 2.5.1 p2
    openbsd openssh 2.5.2 p2
    openbsd openssh 2.9.9 p1
    suse suse linux 6.4
    debian debian linux 2.2
    mandrakesoft mandrake linux 7.1
    trustix secure linux 1.1
    redhat linux 7
    mandrakesoft mandrake linux 7.2
    suse suse linux 7.0
    mandrakesoft mandrake linux corporate server 1.0.1
    suse suse linux 7.1
    redhat linux 7.1
    trustix secure linux 1.01
    trustix secure linux 1.2
    mandrakesoft mandrake linux 8.0
    mandrakesoft mandrake single network firewall 7.2
    suse suse linux 7.2
    freebsd freebsd 4.3 -
    trustix secure linux 1.5
    mandrakesoft mandrake linux 8.1
    redhat linux 7.2
    hp secure os 1.0
    suse suse linux 7.3
    freebsd freebsd 4.4 -
    redhat linux 7.3