All customers except US A&D: to ensure that you can access all of your product downloads, you must log in to the Wind River Delivers portal https://delivers.windriver.com and visit the My Products page to force an initial sync of your product entitlement. Only after you’ve completed this step will you be able to access and download product content through the Artifacts, Registry, and Git interfaces. This also applies to users attempting to run the Wind River installer in maintenance or update mode or Linux installation updates at the command line.

Wind River Support Network

HomeDefectsLIN9-2952
Fixed

LIN9-2952 : Security Advisory - openssh - CVE-2016-10010

Created: Jan 12, 2017    Updated: Dec 3, 2018
Resolved Date: Feb 7, 2017
Found In Version: unknown
Fix Version: 9.0.0.3
Severity: Standard
Applicable for: Wind River Linux 9
Component/s: Userspace

Description

https://bugzilla.redhat.com/show_bug.cgi?id=1406278

It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system.

Note: privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH in any version of RHEL is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in  /etc/ssh/sshd_config. More information is also available in https://access.redhat.com/solutions/1354953 .

CVE assignment:

http://seclists.org/oss-sec/2016/q4/708

Upstream patch:

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/serverloop.c.diff?r1=1.188&r2=1.189&sortby=date&f=h

Other Downloads


CVEs


Live chat
Online