CVE-2011-4327: Infoleak
A security flaw was found in the way ssh-keysign, a ssh helper program for host based authentication, attempted to retrieve enough entropy information on configurations that lacked a built-in entropy pool in OpenSSL (a ssh-rand-helper program would be executed to retrieve the entropy from the system environment). A local attacker could use this flaw to obtain unauthorized access to host keys via ptrace(2) process trace attached to the 'ssh-rand-helper' program.
References: [1] http://www.openssh.com/txt/release-5.8p2 [2] http://www.openssh.com/txt/portable-keysign-rand-helper.adv [3] http://www.nessus.org/plugins/index.php?view=single&id=53841 [4] http://www.openwall.com/lists/oss-security/2011/11/21/11 (CVE assignment)
Other sources
ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4327?
CVE-2011-4327 has been rated as a medium severity vulnerability due to its potential impact on host-based authentication in OpenSSH.
How do I fix CVE-2011-4327?
To fix CVE-2011-4327, update your OpenSSH to a version that includes the patch for this vulnerability.
What specific versions of OpenSSH are affected by CVE-2011-4327?
CVE-2011-4327 affects multiple versions of OpenSSH, specifically versions from 1.2.1 up to but not including 5.8.
What impact does CVE-2011-4327 have on systems using OpenSSH?
CVE-2011-4327 can lead to insufficient entropy in host-based authentication, potentially exposing systems to security risks.
Is there a workaround for CVE-2011-4327 if I cannot update OpenSSH?
As a workaround, consider implementing additional entropy sources or using an alternative authentication method until an update can be applied.