漏洞类别：Amazon Linux
漏洞等级： 
漏洞信息
It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root.
漏洞危害
Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.
解决方案
Please refer to Amazon advisory ALAS-2016-770 for affected packages and patching details, or update with your package manager.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
ALAS-2016-770: Amazon Linux (openssh (6.6.1p1-31.62.amzn1) on i686)
ALAS-2016-770: Amazon Linux (openssh (6.6.1p1-31.62.amzn1) on x86_64)
ALAS-2016-770: Amazon Linux (openssh (6.6.1p1-31.62.amzn1) on src)
0day
文章评论