Test ID:	1.3.6.1.4.1.25623.1.0.105003
Category:	General
Title:	OpenSSH 'child_set_env()' Function Security Bypass Vulnerability
Summary:	OpenSSH is prone to a security bypass vulnerability.
Description:	Summary: OpenSSH is prone to a security bypass vulnerability. Vulnerability Insight: sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config. Vulnerability Impact: The security bypass allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. Affected Software/OS: Versions prior to OpenSSH 6.6 are vulnerable. Solution: Updates are available. Please see the references for more information. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2532 http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html BugTraq ID: 66355 http://www.securityfocus.com/bid/66355 Debian Security Information: DSA-2894 (Google Search) http://www.debian.org/security/2014/dsa-2894 http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html HPdes Security Advisory: HPSBUX03188 http://marc.info/?l=bugtraq&m=141576985122836&w=2 HPdes Security Advisory: SSRT101487 http://www.mandriva.com/security/advisories?name=MDVSA-2014:068 http://www.mandriva.com/security/advisories?name=MDVSA-2015:095 http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2 RedHat Security Advisories: RHSA-2014:1552 http://rhn.redhat.com/errata/RHSA-2014-1552.html http://www.securitytracker.com/id/1029925 http://secunia.com/advisories/57488 http://secunia.com/advisories/57574 http://secunia.com/advisories/59313 http://secunia.com/advisories/59855 http://www.ubuntu.com/usn/USN-2155-1 XForce ISS Database: openssh-cve20142532-sec-bypass(91986) https://exchange.xforce.ibmcloud.com/vulnerabilities/91986
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.