CVE-2014-9278: Medium severity openssh vulnerability
IssueDescription:
In a Kerberos environment, OpenSSH allows remote, authenticated users to log in as another user if they are listed in a ~/.k5users file of that other user. This unexpectedly alters the system security policy, as expressed through the ~/.k5users file, because previously, users would have to log in locally, potentially requiring different forms of authentication, before they could use the ksu command to switch users.
Other sources
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9278?
CVE-2014-9278 has been classified as a moderate severity vulnerability.
How do I fix CVE-2014-9278?
To fix CVE-2014-9278, ensure that proper controls are in place for the ~/.k5users file and limit user permissions accordingly.
Who is affected by CVE-2014-9278?
CVE-2014-9278 affects users of OpenSSH in a Kerberos environment.
What is the impact of CVE-2014-9278?
The impact of CVE-2014-9278 allows remote authenticated users to impersonate other users inappropriately.
Is there a patch available for CVE-2014-9278?
Yes, a patch for CVE-2014-9278 was included in subsequent OpenSSH releases.