Description
A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openssh +3 | 4.3p2-36.el5_4.2 | RHSA-2009:1470 |
Advisories 1
- RHSA-2009:1470 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- 36552 vdb-entry
- RHSA-2009:1470 vendor-advisory
- FEDORA-2010-5429 vendor-advisory
- 38834 third-party-advisory
- 58495 vdb-entry
- 39182 third-party-advisory
- oval:org.mitre.oval:def:9862 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=522141
- ADV-2010-0528 vdb-entry