New answers tagged

1

CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices This vulnerability has low impact on RHEL, because by default the option ChallengeResponseAuthentication is disabled in default configuration. Though it is or will be fixed in RHEL 6 and 7. CVE-2016-1907: openssh: out-of-bounds read in packet handling code This one does not ...


3

This is good question. I investigated this issue two weeks ago as it was out. This bug appeared for the first time in openssh-6.8 in refactoring commit. Basically the issue is that there was replaced function which called exit() with function only returning error value. if (state->packlen < 1 + 4 || state->packlen > PACKET_MAX_SIZE) { #ifdef ...


4

A CVE is a vulnerability description, ie. a document stating that some security property has been found to be broken. As explained in Ohnana's comment, a CVE might indeed state that to be exploitable some other security properties not part of this CVE should also be broken (typically CVE requiring a specific access from the attacker, whether it is local, ...


2

First of all, yes; if your kernel supports keyrings, then docker doesn't prevent their use, which means they also don't prevent exploitation. But it's worth noting that docker containers are not security containers. While they can and usually do offer some level of security, that isn't their purpose, and design decisions were made that are not compatible ...


3

The solution for running out of space in the CVE numbering scheme was to change to a "new format" that allows for additional digits in the last part of the CVE ID as needed. A request for input into the new format selection was put out in January 2013, with a decision announced in July of the same year, and the policy went into effect at the start of 2014. A ...


3

The industry will not fall apart, because such an outcome would mean that the industry at large minds CVE numbers and acknowledges their existence; the day this will become true will be a glorious day indeed.


10

This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between all docker instances and the OS containing the docker instances. This is the highest privilege one could get and at this level one can bypass any kind of ...


3

You could try the exploit directly on any given host and determine your own level-of risk. My initial thought is that even on Android, many kernels have SMEP/SMAP enabled, thus preventing the canned exploit code above. One would need to rewrite the exploit with ROP or use a similar SMEP/SMAP bypass technique. (Update 2016/Feb/06 -- Collin R. Mulliner ...



Top 50 recent answers are included