我們使用 cookie 來幫助我們改善網頁體驗。請閱讀我們的 Cookie 政策 。

ASUSTOR 產品安全性諮詢

AS-2023-013: OpenSSH

2023-11-29

Severity

Important

Status

Resolved

Statement

OpenSSH versions prior to 9.3p2 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data.

CVE-2023-38408 affected ASUSTOR products with ADM 4.2 and ADM 4.0. Updates with OpenSSH 9.5p1 will be released as soon as possible.

  • OpenSSH 9.5p1 has been updated on ADM 4.2.5.RN33 and ADM 4.0.6.RNS1 to resolve the issue.

Affected Products

Product Severity Fixed Release Availability
ADM 4.2 and 4.1 Important Upgrade to ADM 4.2.5.RN33 or above.
ADM 4.0 Important Upgrade to ADM 4.0.6.RNS1 or above

Detail

  • CVE-2023-38408
    • Severity: Critical
    • The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Reference


Revision

Revision Date Description
1 2023-10-25 Initial public release.
2 2023-11-06 Release ADM 4.2.5.RN33 to update OpenSSH version for fixing the issue.
3 2023-11-29 Release ADM 4.0.6.RNS1 to update OpenSSH version for fixing the issue.