Threat Advisory

regreSSHion: A New OpenSSH Unauthenticated Remote Code Execution Vulnerability

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY

The Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH's server (sshd) in glibc-based Linux systems is a regression of the previously patched vulnerability CVE-2006-5051. This vulnerability allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems. If exploited, this could lead to a complete system compromise, allowing an attacker to execute arbitrary code with the highest privileges, resulting in a complete system takeover, malware installation, data manipulation, and the creation of backdoors for persistent access. Gaining root access would allow attackers to bypass critical security mechanisms, obscuring their activities. This could result in significant data breaches and leakage, giving attackers access to all system data, including sensitive or proprietary information. Memory corruption and overcoming Address Space Layout Randomization (ASLR) are necessary to mitigate the risk.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY

The Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH's server (sshd) in glibc-based Linux systems is a regression of the previously patched vulnerability CVE-2006-5051. This vulnerability allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems. If exploited, this could lead to a complete system compromise, allowing an attacker to execute arbitrary code with the highest privileges, resulting in a complete system takeover, malware installation, data manipulation, and the creation of backdoors for persistent access. Gaining root access would allow attackers to bypass critical security mechanisms, obscuring their activities. This could result in significant data breaches and leakage, giving attackers access to all system data, including sensitive or proprietary information. Memory corruption and overcoming Address Space Layout Randomization (ASLR) are necessary to mitigate the risk.[emaillocker id="1283"]

  • CVE-2024-6387: This has the potential to grant root-level privileges through unauthenticated remote code execution (RCE). The severity of this vulnerability is classified as High (CVSS 8.1). The subsequent versions of the OpenSSH server are affected by this vulnerability: Open SSH versions between 8.5p1 and 9.8p1. Open SSH versions prior to 4.4p1 if they haven't been backported against CVE-2006-5051 or fixed against CVE-2008-4109.

RECOMMENDATION:

  • We strongly recommend you update all OpenSSH instances to the latest version, later than v9.8p1.

REFERENCES:

The following reports contain further technical details:

https://www.bleepingcomputer.com/news/security/new-regresshion-openssh-rce-bug-gives-root-on-linux-servers/

[/emaillocker]
crossmenu