My system is vulnerable to OpenSSH Wildcards on AcceptEnv Vulnerability, CVE-2014-2532.

I have tried to update openssh to version 6.6 for centos but I can not get repository[sic] for that version.

/EDIT/ PCI-DSS compliance is a driving factor for this question.

  • 1
    This is a mostly technical forum, so the fact that PCI DSS is driving your desire to upgrade OpenSSH is not very relevant. Regardless, @HBruijn has given you an excellent answer regarding the justification for the compliance aspect. As for the technical, you might consider adding specific details such as what version of CentOS and what repositories you have already tried. – 0xSheepdog Jun 11 '14 at 15:59
  • 1
    @0xSheepdog: About adding sic. You're editing the question, not quoting it, so that doesn't really make sense. I suggest just fixing the error instead. (If you can't make heads or tails out of what the line means, just leave it, and even better leave a comment to the OP asking for clarification). – derobert Jun 13 '14 at 16:15

The PCI requirement is to:

ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.

Just randomly downloading unsupported alternative software versions is not what you should be doing...

The Vendor Response is:

The Red Hat Security Response Team has rated this issue as having Low security impact, a future update may address this flaw.

So no Red Hat fix for now and therefore no CentOS fix either.

The reason for that Low Risk assessment is because the default configuration that is shipped by Red Hat and CentOS does not include wildcard (*) AcceptEnv values.

Now the question is, are you vulnerable because you changed the vendor supplied defaults? If so, can you remove/rewrite your custom AcceptEnv wildcards making your system secure again?

Or is the auditor just triggered by the openssh software version number are you not really vulnerable at all?

Because the latter happens all the time...

  • Excellent answer on multiple levels. Compliance, security, and configuration management. Huzzah! – 0xSheepdog Jun 11 '14 at 15:56
  • 2
    @0xSheepdog But it doesn't really answer the question anymore since you removed PCI from the original question. ;-) – Dubu Jun 12 '14 at 7:05
  • Yeah, I noticed that after the fact. I'm still getting the hang of SE... I didn't know if it was easier to put it back or make a comment or what. Then, something came up and my attention was drawn away... #SQUIRREL – 0xSheepdog Jun 13 '14 at 15:51
  • What changes i need to implement in sshd_config to resolve this security issue. – pravin09 Jun 27 '14 at 11:59
  • Ensure that the AcceptEnv directives in your sshd_config do not include wildcards. The line Accept_Env LC_* is bad, while explictely listing accepted environment variables is good: AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY <snip> etc. – HBruijn Jun 27 '14 at 12:06

I have the some problem than you.

My solution was activate the CentOS continous repository in my machines.

yum install centos-release-cr

The CR reason is described here: http://centosnow.blogspot.com/2014/10/continuous-release-repository-rpms-for.html

you can install the repo using this yum command:

yum install centos-release-cr

after that, i was able to install the last openssh package (5.3p1-104.el6) have the CVE resolve.

more information about continuous release : http://wiki.centos.org/AdditionalResources/Repositories/CR

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.