CVE-2015-8325: High severity Debian Debian Linux vulnerability
If PAM is configured to read user-specified environment variables and UseLogin=yes in sshdconfig, then a hostile local user may attack /bin/login via LDPRELOAD or similar environment variables set via PAM.
Upstream fix:
https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
Debian advisory:
https://www.debian.org/security/2016/dsa-3550
Other sources
The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LDPRELOAD environment variable.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8325?
CVE-2015-8325 is considered a high severity vulnerability due to the risk of local privilege escalation.
How do I fix CVE-2015-8325?
To fix CVE-2015-8325, update your OpenSSH package to a version that includes the security patch.
What systems are affected by CVE-2015-8325?
CVE-2015-8325 affects systems with vulnerable versions of OpenSSH, particularly those configured with UseLogin enabled.
Who can exploit CVE-2015-8325?
CVE-2015-8325 can be exploited by a local user with access to environment variables.
Is CVE-2015-8325 patched in recent OpenSSH versions?
Yes, CVE-2015-8325 has been patched in recent versions of OpenSSH as indicated in the upstream fix.