CVE-2009-2904 Privilege escalation in n/a

Medium 6.9 Published 1 Oct 2009 Updated 7 Aug 2024

Local users can escalate privileges by exploiting hard links to setuid programs within a chroot directory in OpenSSH.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2009-2904?

CVE-2009-2904 is a medium-severity vulnerability in OpenSSH, published on 1 Oct 2009. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.

Weakness: CWE-16

Which versions are affected by CVE-2009-2904?

It affects 1 product.

Linux distribution packages (10)

`openssh` Red Hat:enterprise_linux:5::client	All versions	`0:4.3p2-36.el5_4.2`
`openssh-askpass` Red Hat:enterprise_linux:5::client	All versions	`0:4.3p2-36.el5_4.2`
`openssh-clients` Red Hat:enterprise_linux:5::client	All versions	`0:4.3p2-36.el5_4.2`
`openssh-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:4.3p2-36.el5_4.2`
`openssh-server` Red Hat:enterprise_linux:5::client	All versions	`0:4.3p2-36.el5_4.2`
`openssh` Red Hat:enterprise_linux:5::server	All versions	`0:4.3p2-36.el5_4.2`
`openssh-askpass` Red Hat:enterprise_linux:5::server	All versions	`0:4.3p2-36.el5_4.2`
`openssh-clients` Red Hat:enterprise_linux:5::server	All versions	`0:4.3p2-36.el5_4.2`
`openssh-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:4.3p2-36.el5_4.2`
`openssh-server` Red Hat:enterprise_linux:5::server	All versions	`0:4.3p2-36.el5_4.2`

Products include OpenSSH.

How do I fix CVE-2009-2904?

Apply the vendor's patch.

Is CVE-2009-2904 being exploited?

There is no known exploitation of CVE-2009-2904 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as GHSA-73m8-jfrm-fr4j, RHSA-2009:1470.