diff options
| author | Damien Miller <djm@mindrot.org> | 2016-04-13 10:39:57 +1000 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2016-04-13 08:44:57 +0100 |
| commit | 7f3fb4e5fdddc6600e70ae663c21511fbcf2c64c (patch) | |
| tree | ba42cc0da68c4c3c985341f87ba9b30081d4cc63 /debian/openssh-server.postinst | |
| parent | d888c9637031a93c13c168a35e99e9aa76c14a9a (diff) | |
ignore PAM environment vars when UseLogin=yes
If PAM is configured to read user-specified environment variables
and UseLogin=yes in sshd_config, then a hostile local user may
attack /bin/login via LD_PRELOAD or similar environment variables
set via PAM.
CVE-2015-8325, found by Shayan Sadigh, via Colin Watson
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
Last-Update: 2016-04-13
Patch-Name: CVE-2015-8325.patch
Diffstat (limited to 'debian/openssh-server.postinst')
0 files changed, 0 insertions, 0 deletions