CVE-1999-0013: High severity SSH ssh vulnerability
Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
ssh-agent (SSH)from your environment.Uninstall or remove the ssh-agent program from systems where it is not required.
- Configuration
Disable or stop ssh-agent on systems where it is not required to prevent credentials from being exposed to other local users.
ssh-agent (SSH) enabled = false - Compensating control
Ensure local users cannot access another user's ssh-agent socket (SSH_AUTH_SOCK); restrict filesystem permissions and local access so the agent socket is not reachable by other accounts.
- Operational
Assume credentials may be compromised: rotate SSH keys/credentials and revoke any keys or sessions that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0013?
CVE-1999-0013 is considered a moderate severity vulnerability due to the unauthorized access it can allow to remote accounts.
How do I fix CVE-1999-0013?
To fix CVE-1999-0013, upgrade your SSH client to a version greater than 1.2.14 which addresses this vulnerability.
Who is affected by CVE-1999-0013?
Users of SSH versions 1.2.0 through 1.2.14 are affected by CVE-1999-0013 due to the use of the vulnerable ssh-agent program.
What are the risks of not addressing CVE-1999-0013?
Not addressing CVE-1999-0013 can lead to compromised user accounts and unauthorized access to sensitive remote services.
Is CVE-1999-0013 still relevant today?
While CVE-1999-0013 pertains to older SSH versions, it remains a significant case study in credential theft risks for local environments.