CVE-2001-0872: High severity OpenBSD OpenSSH vulnerability
Published Dec 21, 2001
·Updated
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LDPRELOAD, which allows local users to gain root privileges.
Affected Software
9 affected components
OpenBSD OpenSSH<=3.0.1
redhat Linux=7.0
redhat Linux=7.2
SUSE SuSE Linux=7.2
SUSE SuSE Linux=7.0
SUSE SuSE Linux=7.1
SUSE SuSE Linux=6.4
SUSE SuSE Linux=7.3
redhat Linux=7.1
Remediation
Patch Available
Event History
Dec 21, 2001
CVE Published
05:00 AM
Jun 25, 2002
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-0872?
CVE-2001-0872 is considered to be of high severity due to its potential for local users to gain root privileges.
2
How do I fix CVE-2001-0872?
To fix CVE-2001-0872, it is recommended to upgrade OpenSSH to version 3.0.2 or later.
3
Which versions of OpenSSH are affected by CVE-2001-0872?
CVE-2001-0872 affects OpenSSH versions 3.0.1 and earlier with UseLogin enabled.
4
Who is at risk from CVE-2001-0872?
Local users on systems running vulnerable versions of OpenSSH are at risk from CVE-2001-0872.
5
What systems are impacted by CVE-2001-0872?
CVE-2001-0872 impacts several versions of OpenBSD's OpenSSH, as well as Red Hat and SUSE Linux distributions.