Vulnerability Description
A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openbsd | Openssh | 4.3 |
| Fedoraproject | Fedora | 11 |
| Redhat | Enterprise Linux | 5 |
| Redhat | Enterprise Linux Desktop | 5 |
| Redhat | Enterprise Linux Eus | 5 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-March/038214.html
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://osvdb.org/58495
- http://secunia.com/advisories/38794
- http://secunia.com/advisories/38834
- http://secunia.com/advisories/39182
- http://www.securityfocus.com/bid/36552
- http://www.vupen.com/english/advisories/2010/0528
- https://bugzilla.redhat.com/show_bug.cgi?id=522141
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- https://rhn.redhat.com/errata/RHSA-2009-1470.htmlVendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2010-March/038214.html
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://osvdb.org/58495
- http://secunia.com/advisories/38794
FAQ
What is CVE-2009-2904?
CVE-2009-2904 is a vulnerability with a CVSS score of 6.9 (MEDIUM). A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges...
How severe is CVE-2009-2904?
CVE-2009-2904 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-2904?
Check the references section above for vendor advisories and patch information. Affected products include: Openbsd Openssh, Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus.