Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

USN-8514-2: OpenSSH vulnerability

Ubuntu Security Notices ()3 · 1 read
Read at ubuntu.com
AI summary · glm-5.3-flashSummaries by Vani AI

Ubuntu backports an OpenSSH fix to older LTS releases for an scp flaw enabling setuid file placement and privilege escalation.

USN-8514-2 extends the USN-8514-1 OpenSSH fix to Ubuntu 14.04 LTS, 18.04 LTS, and 20.04 LTS. The flaw stems from incorrect file permission handling when downloading files as root using the legacy scp protocol without the preserve-mode option. An attacker could exploit this to install setuid or setgid files on the system, potentially leading to privilege escalation.

Key facts
  • Flaw affects root scp downloads via legacy protocol without preserve-mode
  • Enables planting setuid/setgid files, possibly leading to privilege escalation
  • Update applies the USN-8514-1 fix to Ubuntu 14.04, 18.04, and 20.04 LTS
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
canonicalopensshprivilege-escalationscpubuntu
Vendors
Canonical
Products
OpenSSH
Organizations
Ubuntu

From the original article

USN-8514-1 fixed a vulnerability in OpenSSH. This update provides the corresponding fix for Ubuntu 14. 04 LTS, Ubuntu 18.

Ubuntu Security Notices

ubuntu.com

Read the full article at Ubuntu Security Notices

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.