CVE-2008-1657

Published: Apr 2, 2008Modified: Apr 23, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Affected (6)

Products: Openbsd: Openssh

Openbsd

1 product

Openssh

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Version 4.4
Openbsd Openssh	Version 4.4p1
Openbsd Openssh	Version 4.5
Openbsd Openssh	Version 4.6
Openbsd Openssh	Version 4.7
Openbsd Openssh	Version 4.8

Related CWEs

CWE-264

References (64)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc (unsafe URL)

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/ssh_advisory.asc

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html

Source: cve@mitre.org

http://secunia.com/advisories/29602

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29609

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29683

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29693

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29735

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29939

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/30361

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/31531

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/31882

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/32080

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/32110

Source: cve@mitre.org

Vendor Advisory

http://support.attachmate.com/techdocs/2374.html

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0139

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200804-03.xml

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:098

Source: cve@mitre.org

http://www.openbsd.org/errata43.html#001_openssh

Source: cve@mitre.org

Patch

http://www.openssh.com/txt/release-4.9

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/archive/1/490488/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/28531

Source: cve@mitre.org

Patch

http://www.securitytracker.com/id?1019733

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-649-1

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA08-260A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2008/1035/references

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2008/1624/references

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2008/2396

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2008/2584

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/41549

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-2419

Source: cve@mitre.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc (unsafe URL)