CVE-2008-3234: Medium severity openssh vulnerability

Published Jul 18, 2008

Updated

sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.

Affected Software

2 affected components

OpenBSD OpenSSH=4.0

Debian Debian Linux

Event History

Jul 18, 2008

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

04:41 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-3234?

CVE-2008-3234 is classified as a high severity vulnerability due to its ability to allow remote authenticated users to access arbitrary SELinux roles.

How do I fix CVE-2008-3234?

To fix CVE-2008-3234, upgrade to a patched version of OpenSSH or implement appropriate user role restrictions to prevent exploitation.

Who is affected by CVE-2008-3234?

CVE-2008-3234 affects users of OpenSSH version 4.0 on Debian GNU/Linux systems.

What type of attack does CVE-2008-3234 facilitate?

CVE-2008-3234 facilitates privilege escalation attacks by allowing users to gain access to unauthorized SELinux roles.

Is CVE-2008-3234 present in later versions of OpenSSH?

CVE-2008-3234 is not present in OpenSSH versions released after 4.0, as subsequent versions have patched this vulnerability.