CVE-2012-0814: Medium severity OpenBSD OpenSSH vulnerability
The authparseoptions function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorizedkeys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorizedkeys file in its own home directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0814?
CVE-2012-0814 has a medium severity rating due to its potential to expose sensitive information from debug messages.
How do I fix CVE-2012-0814?
To fix CVE-2012-0814, upgrade OpenSSH to version 5.7 or later, where the issue has been resolved.
Who is affected by CVE-2012-0814?
CVE-2012-0814 affects remote authenticated users on systems running vulnerable versions of OpenSSH prior to 5.7.
What are the implications of CVE-2012-0814?
The implications of CVE-2012-0814 include unauthorized access to potentially sensitive command options specified in the authorized_keys file.
Can CVE-2012-0814 be exploited remotely?
Yes, CVE-2012-0814 can be exploited remotely by authenticated users who can access debug messages revealing sensitive information.