Description
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges.
References
- MDKSA-2001:092 vendor-advisory
- HPSBUX0112-005 vendor-advisory
- openssh-uselogin-execute-code(7647) vdb-entry
- 688 vdb-entry
- DSA-091 vendor-advisory
- 20011204 [Fwd: OpenSSH 3.0.2 fixes UseLogin vulnerability] mailing-list
- VU#157447 third-party-advisory
- RHSA-2001:161 vendor-advisory
- http://marc.info/?l=openssh-unix-dev&m=100747128105913&w=2
- 3614 vdb-entry
- SuSE-SA:2001:045 vendor-advisory
- CLA-2001:446 vendor-advisory
- M-026 third-party-advisory government-resource