Vulnerability in OpenSSH could allow remote code execution

A vulnerability has been discovered in OpenSSH that could allow remote code execution. OpenSSH is a suite of secure network utilities based on the SSH protocol and is essential for secure communication over unsecured networks. It is widely used in enterprise environments for remote server management, secure file transfers, and various DevOps practices. Successful exploitation of this vulnerability could allow remote code execution in the context of the administrator account. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

There are no reports of this vulnerability being exploited in the wild.

A vulnerability has been discovered in OpenSSH that could allow remote code execution. Details of the ilncude vulnerability:

Tactical: Initial access (TA0001):

Technical: Exploit a public application (T1190):

• A race condition vulnerability exists in sshd(8) that could allow unauthenticated remote code execution on the OpenSSH server (sshd) that grants full root access. It affects the default configuration and does not require user interaction. It poses a significant risk of exploitation. (CVE-2024-6387)

We recommend taking the following measures:

• Apply appropriate updates provided by OpenSSH to vulnerable systems immediately after appropriate testing.M1051:Software Update)
  • Safeguard 7.1: Establish and maintain a vulnerability management process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually or when significant changes in the business may impact this safeguard.
  • Safeguard 7.4: Perform automated application patch management: Perform application updates on enterprise assets with automated patch management on a monthly or more frequent basis.
  • Safeguard 7.6: Perform automated vulnerability scans of externally exposed enterprise assets: Perform automated vulnerability scans of externally exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly or more frequent basis.
  • Backup 7.7: Address detected vulnerabilities: Remediate vulnerabilities detected in software through processes and tools on a monthly or more frequent basis, depending on the remediation process.
• Apply the principle of least privilege to all systems and services. Run all software as an unprivileged user (without administrative privileges) to reduce the effects of a successful attack.M1026:Management of privileged accounts)
  • Safeguard 4.7: Manage default accounts on company assets and software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Implementation examples may include: disabling default accounts or preventing them from being used.
  • Safeguard 5.4: Restrict administrator privileges to dedicated administrator accounts: Limit administrator privileges to dedicated administrator accounts on company assets. Perform general computing activities, such as Internet browsing, email, and productivity suite use, from users' primary, non-privileged accounts.
• Prevent access to file shares, remote access to systems, unnecessary services. Access limitation mechanisms may include the use of network hubs, RDP gateways, etc. (M1035:Limit access to resources on the network)
• Use intrusion detection signatures to block traffic at network boundaries.M1031: Network intrusion prevention)
  • Protective measure 13.3: Deploy a network intrusion detection solution: Deploy a network intrusion detection solution on enterprise assets, if applicable. Examples of implementation include using a network intrusion detection system (NIDS) or equivalent cloud service provider (CSP) service.
  • Safeguard 13.8: Deploy a network intrusion prevention solution: Deploy a network intrusion prevention solution, if applicable. Examples of implementation include using a Network Intrusion Prevention System (NIPS) or equivalent CSP service.
• Use features to detect and block conditions that may lead to or indicate that software exploitation is occurring.M1050:Exploit Protection)
  • Backup 13.10: Performing Application Layer Filtering: Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.