A flaw in OpenSSH helper programs could lead to local privilege escalation

Brocade Fabric OS

1 more products

22340

01 August 2023

01 August 2023

CLOSED

MEDIUM

7.0 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-41617

Brocade Security Advisory ID

BSA-2023-1604

Component

OpenSSH

 

 

Summary

A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privileges, potentially leading to local privilege escalation

 

Products Affected

Brocade Fabric OS 9.x versions prior to v9.1.1

Brocade ASCG versions prior to v2.1

 

Products Confirmed Not Affected

Brocade Fabric OS v8.x and v7.x are not affected by this vulnerability

Brocade SANnav is not affected by this vulnerability

 

Solution

Solutions provided in Brocade Fabric OS v9.1.1, v9.2.0 and later versions and in Brocade ASCG v2.1 and later versions.

 

 

Revision History

Version

Change

Date

1.0

Initial Publication

 August 1, 2023

 

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.