Vulnerability in Openbsd Openssh
CVE-2013-4548
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.
EPSS: 0.027 (84.2th percentile) — read the EPSS interpretation.
Affected products
- Openbsd Openssh — versions 6.2, 6.3
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_HP, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
Frequently asked questions
- What is CVE-2013-4548?
- CVE-2013-4548 is a vulnerability in Openbsd Openssh, classified under CWE-264. Published 2013-11-08.
- Is CVE-2013-4548 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.