CVE-2014-9278 Auth bypass in n/a
Remote authenticated users can bypass local login requirements to log in as another user in Kerberos-enabled OpenSSH environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9278?
CVE-2014-9278 is a medium-severity authentication bypass vulnerability in OpenSSH, published on 6 Dec 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
Weakness: CWE-287
Which versions are affected by CVE-2014-9278?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2014-9278?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2014-9278 being exploited?
There is no known exploitation of CVE-2014-9278 in the wild and no public exploit code.
Other vulnerabilities in OpenSSH
Sources
Also known as GHSA-q38j-wxrx-r48r.