Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

My system is vulnerable to OpenSSH Wildcards on AcceptEnv Vulnerability, CVE-2014-2532.

I have tried to update openssh to version 6.6 for centos but I can not get repository[sic] for that version.

/EDIT/ PCI-DSS compliance is a driving factor for this question.

share|improve this question
1  
This is a mostly technical forum, so the fact that PCI DSS is driving your desire to upgrade OpenSSH is not very relevant. Regardless, @HBruijn has given you an excellent answer regarding the justification for the compliance aspect. As for the technical, you might consider adding specific details such as what version of CentOS and what repositories you have already tried. –  0xSheepdog Jun 11 at 15:59
1  
@0xSheepdog: About adding sic. You're editing the question, not quoting it, so that doesn't really make sense. I suggest just fixing the error instead. (If you can't make heads or tails out of what the line means, just leave it, and even better leave a comment to the OP asking for clarification). –  derobert Jun 13 at 16:15

1 Answer 1

The PCI requirement is to:

ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.

Just randomly downloading unsupported alternative software versions is not what you should be doing...

The Vendor Response is:

The Red Hat Security Response Team has rated this issue as having Low security impact, a future update may address this flaw.

So no Red Hat fix for now and therefore no CentOS fix either.

The reason for that Low Risk assessment is because the default configuration that is shipped by Red Hat and CentOS does not include wildcard (*) AcceptEnv values.

Now the question is, are you vulnerable because you changed the vendor supplied defaults? If so, can you remove/rewrite your custom AcceptEnv wildcards making your system secure again?

Or is the auditor just triggered by the openssh software version number are you not really vulnerable at all?

Because the latter happens all the time...

share|improve this answer
    
Excellent answer on multiple levels. Compliance, security, and configuration management. Huzzah! –  0xSheepdog Jun 11 at 15:56
2  
@0xSheepdog But it doesn't really answer the question anymore since you removed PCI from the original question. ;-) –  Dubu Jun 12 at 7:05
    
Yeah, I noticed that after the fact. I'm still getting the hang of SE... I didn't know if it was easier to put it back or make a comment or what. Then, something came up and my attention was drawn away... #SQUIRREL –  0xSheepdog Jun 13 at 15:51
    
What changes i need to implement in sshd_config to resolve this security issue. –  pravin09 Jun 27 at 11:59
    
Ensure that the AcceptEnv directives in your sshd_config do not include wildcards. The line Accept_Env LC_* is bad, while explictely listing accepted environment variables is good: AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY <snip> etc. –  HBruijn Jun 27 at 12:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.