Researchers discovered a vulnerability in OpenSSH. More than fourteen million server programs are affected.
‘RegreSSHion,’ as the vulnerability in OpenSSH is also called, is “extremely dangerous,” according to researchers. It involves a flaw that allows code to be run remotely by an unauthorized user. The problem is in OpenSSH’s server program in glibc-based server systems, which are used to encrypt and securely transfer communications over unsecured networks.
Qualys researchers came across the vulnerability. The name “regreSSHion” is appropriate because it is a regression of a vulnerability patched in 2006. “Regression in this context means that a flaw, after being fixed, has reappeared in a subsequent software version, usually due to changes or updates that unintentionally reintroduce the problem.”
Full control
Exploitation of vulnerability CVE-2024-6387 can give hackers complete control over systems. It then becomes possible to run malicious code based on the highest privileges. Hackers can also abuse the access to install backdoors in an attempt to stay in the system after the correct patch has been installed.
Hackers are able to do this with a specially designed payload but also need a lot of luck to get in. This is because the vulnerability causes the timing at which the signal is processed to occasionally overlap with the timing at which the system is processing. The payload should be sent just at this moment of overlap.
OpenSSH versions before 4.4p1 are vulnerable unless users patch for CVE-2006-5051 and CVE-2008-4109. Versions from 8.5p1 to 9.8p1 are also vulnerable. The bug has been fixed in version 9.8. Users are encouraged to install the patches as soon as possible.
Tip! ‘Vigilance required to counter infiltration attempts of open-source projects’