CVE-2014-9278

OpenSSH - Authenticated User Impersonation via .k5users File

Title source: llm
STIX 2.1

Description

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/71420
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/12/04/17
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0425.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1169843
Issue Tracking x_refsource_confirm
https://bugzilla.mindrot.org/show_bug.cgi?id=1867
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/99090
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/12/02/3

Scores

EPSS 0.0035
EPSS Percentile 57.6%

Details

CWE
CWE-287
Status published
Products (1)
openbsd/openssh
Published Dec 06, 2014
Tracked Since Feb 18, 2026