CVE-2013-4548

The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a…

published November 8, 2013

CVSS
—
EPSS
3%
Percentile
85.6
In the wild
Unconfirmed
What it is

The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02670 · 85.6th percentile
Published
2013-11-08T15:00Z
EPSS history
Timeline
  • 08 NOV 15:00Z
    The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a…
    cvelistv5