CVE-2013-4548 Security feature bypass in n/a
Authenticated users can bypass ForceCommand and login-shell restrictions in OpenSSH when using AES-GCM ciphers due to improper memory initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4548?
CVE-2013-4548 is a medium-severity vulnerability in OpenSSH, published on 8 Nov 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.
Weakness: CWE-264
Which versions are affected by CVE-2013-4548?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2013-4548?
Upgrade to a fixed version.
Is CVE-2013-4548 being exploited?
There is no known exploitation of CVE-2013-4548 in the wild and no public exploit code.
Other vulnerabilities in OpenSSH
Sources
Also known as DEBIAN-CVE-2013-4548, GHSA-wg6r-5vgg-89fv.