Vulnerability-Lookup

CVE-2007-4752 (GCVE-0-2007-4752)

Vulnerability from cvelistv5 – Published: 2007-09-12 01:00 – Updated: 2024-08-07 15:08

Summary

ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2316 records in the last 180 days details

References

30 references

URL	Tags
http://www.openssh.com/txt/release-4.7	x_refsource_CONFIRM
http://security.gentoo.org/glsa/glsa-200711-02.xml	vendor-advisoryx_refsource_GENTOO
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.debian.org/security/2008/dsa-1576	vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/25628	vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/479760/100…	mailing-listx_refsource_BUGTRAQ
http://support.avaya.com/elmodocs2/security/ASA-2…	x_refsource_CONFIRM
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://www.ubuntu.com/usn/usn-566-1	vendor-advisoryx_refsource_UBUNTU
http://securityreason.com/securityalert/3126	third-party-advisoryx_refsource_SREASON
http://www.vupen.com/english/advisories/2008/0924…	vdb-entryx_refsource_VUPEN
http://www.vupen.com/english/advisories/2008/2821	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/30249	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2007/3156	vdb-entryx_refsource_VUPEN
http://h20000.www2.hp.com/bizsupport/TechSupport/…	vendor-advisoryx_refsource_HP
http://secunia.com/advisories/31575	third-party-advisoryx_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2008-08…	vendor-advisoryx_refsource_REDHAT
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
https://bugzilla.redhat.com/show_bug.cgi?id=280471	x_refsource_MISC
http://secunia.com/advisories/29420	third-party-advisoryx_refsource_SECUNIA
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://www.securityfocus.com/archive/1/483748/100…	mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/27399	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
https://issues.rpath.com/browse/RPL-1706	x_refsource_CONFIRM
http://docs.info.apple.com/article.html?artnum=307562	x_refsource_CONFIRM
http://bugs.gentoo.org/show_bug.cgi?id=191321	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/32241	third-party-advisoryx_refsource_SECUNIA

Date Public

2007-09-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:08:33.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openssh.com/txt/release-4.7"
          },
          {
            "name": "GLSA-200711-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
          },
          {
            "name": "oval:org.mitre.oval:def:10809",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
          },
          {
            "name": "DSA-1576",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1576"
          },
          {
            "name": "25628",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25628"
          },
          {
            "name": "20070917 FLEA-2007-0055-1 openssh openssh-client openssh-server gnome-ssh-askpass",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
          },
          {
            "name": "FEDORA-2007-715",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
          },
          {
            "name": "USN-566-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-566-1"
          },
          {
            "name": "3126",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3126"
          },
          {
            "name": "ADV-2008-0924",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0924/references"
          },
          {
            "name": "ADV-2008-2821",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2821"
          },
          {
            "name": "30249",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30249"
          },
          {
            "name": "ADV-2007-3156",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3156"
          },
          {
            "name": "SSRT071485",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
          },
          {
            "name": "31575",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31575"
          },
          {
            "name": "RHSA-2008:0855",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
          },
          {
            "name": "MDKSA-2007:236",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
          },
          {
            "name": "oval:org.mitre.oval:def:5599",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
          },
          {
            "name": "29420",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29420"
          },
          {
            "name": "APPLE-SA-2008-03-18",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
          },
          {
            "name": "20071115 Re: HPSBUX02287 SSRT071485 rev.1 - HP-UX Running HP Secure Shell, Remotely Gain Extended Privileges",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
          },
          {
            "name": "HPSBUX02287",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
          },
          {
            "name": "27399",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27399"
          },
          {
            "name": "openssh-x11cookie-privilege-escalation(36637)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-1706"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=307562"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
          },
          {
            "name": "SUSE-SR:2007:022",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
          },
          {
            "name": "32241",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32241"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-09-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openssh.com/txt/release-4.7"
        },
        {
          "name": "GLSA-200711-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
        },
        {
          "name": "oval:org.mitre.oval:def:10809",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
        },
        {
          "name": "DSA-1576",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1576"
        },
        {
          "name": "25628",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25628"
        },
        {
          "name": "20070917 FLEA-2007-0055-1 openssh openssh-client openssh-server gnome-ssh-askpass",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
        },
        {
          "name": "FEDORA-2007-715",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
        },
        {
          "name": "USN-566-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-566-1"
        },
        {
          "name": "3126",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3126"
        },
        {
          "name": "ADV-2008-0924",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0924/references"
        },
        {
          "name": "ADV-2008-2821",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2821"
        },
        {
          "name": "30249",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30249"
        },
        {
          "name": "ADV-2007-3156",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3156"
        },
        {
          "name": "SSRT071485",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
        },
        {
          "name": "31575",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31575"
        },
        {
          "name": "RHSA-2008:0855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
        },
        {
          "name": "MDKSA-2007:236",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
        },
        {
          "name": "oval:org.mitre.oval:def:5599",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
        },
        {
          "name": "29420",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29420"
        },
        {
          "name": "APPLE-SA-2008-03-18",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
        },
        {
          "name": "20071115 Re: HPSBUX02287 SSRT071485 rev.1 - HP-UX Running HP Secure Shell, Remotely Gain Extended Privileges",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
        },
        {
          "name": "HPSBUX02287",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
        },
        {
          "name": "27399",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27399"
        },
        {
          "name": "openssh-x11cookie-privilege-escalation(36637)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-1706"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=307562"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
        },
        {
          "name": "SUSE-SR:2007:022",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
        },
        {
          "name": "32241",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32241"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4752",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.openssh.com/txt/release-4.7",
              "refsource": "CONFIRM",
              "url": "http://www.openssh.com/txt/release-4.7"
            },
            {
              "name": "GLSA-200711-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
            },
            {
              "name": "oval:org.mitre.oval:def:10809",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
            },
            {
              "name": "DSA-1576",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1576"
            },
            {
              "name": "25628",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25628"
            },
            {
              "name": "20070917 FLEA-2007-0055-1 openssh openssh-client openssh-server gnome-ssh-askpass",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
            },
            {
              "name": "FEDORA-2007-715",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
            },
            {
              "name": "USN-566-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-566-1"
            },
            {
              "name": "3126",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3126"
            },
            {
              "name": "ADV-2008-0924",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/0924/references"
            },
            {
              "name": "ADV-2008-2821",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2821"
            },
            {
              "name": "30249",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30249"
            },
            {
              "name": "ADV-2007-3156",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3156"
            },
            {
              "name": "SSRT071485",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
            },
            {
              "name": "31575",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31575"
            },
            {
              "name": "RHSA-2008:0855",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
            },
            {
              "name": "MDKSA-2007:236",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
            },
            {
              "name": "oval:org.mitre.oval:def:5599",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=280471",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
            },
            {
              "name": "29420",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29420"
            },
            {
              "name": "APPLE-SA-2008-03-18",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
            },
            {
              "name": "20071115 Re: HPSBUX02287 SSRT071485 rev.1 - HP-UX Running HP Secure Shell, Remotely Gain Extended Privileges",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
            },
            {
              "name": "HPSBUX02287",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
            },
            {
              "name": "27399",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27399"
            },
            {
              "name": "openssh-x11cookie-privilege-escalation(36637)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-1706",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-1706"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=307562",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=307562"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=191321",
              "refsource": "CONFIRM",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
            },
            {
              "name": "SUSE-SR:2007:022",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
            },
            {
              "name": "32241",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32241"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-4752",
    "datePublished": "2007-09-12T01:00:00.000Z",
    "dateReserved": "2007-09-07T00:00:00.000Z",
    "dateUpdated": "2024-08-07T15:08:33.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2007-4752",
      "date": "2026-10-13",
      "epss": "0.02374",
      "percentile": "0.8342"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A410C8F9-717C-4657-91DD-BAEAB53ECC16",
                    "versionEndIncluding": "4.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E003AB3C-8DF3-4AE8-82A3-984F30E5599B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.0p1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5EBE75FE-DDE2-43BA-80EF-15A6698EABC9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1FF67D77-02AC-4807-984D-C5AE9799F051",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.1p1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "683B26F0-5EA2-455A-8948-27C100BBA3AC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E5A75B23-2DD7-4EB2-BEAA-049FF4E51A14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.2p1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7279E1EC-DEBC-4ACC-925D-06A7697C162F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7910598E-BEC1-4644-9DE4-D8BE505A4F9E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.3p1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FB416D0C-6C86-450F-8917-D4B1BD82AB1E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.3p2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3640CCC9-EC4A-44A4-B747-7BAAAD3460C7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B2DD362E-9EA9-4E88-9A94-D7B471EB1FD4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.4p1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E3094069-AC2E-43BD-8094-D48E2526DECC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openbsd:openssh:4.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B72CFB3-39C7-469C-AA59-69F5B8993BF7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted."
          },
          {
            "lang": "es",
            "value": "ssh en OpenSSH anterior a 4.7 no maneja adecuadamente cuando una cookie no confiable no puede ser creada y utiliza una cookie X11 confiable en su lugar, lo cual permite a los atacantes violar pol\u00edticas establecidas y obtener privilegios provocando que un cliente X sea tratado como confiable."
          }
        ],
        "id": "CVE-2007-4752",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": true,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2007-09-12T01:17:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://docs.info.apple.com/article.html?artnum=307562"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/27399"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/29420"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/30249"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/31575"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/32241"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securityreason.com/securityalert/3126"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.debian.org/security/2008/dsa-1576"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.openssh.com/txt/release-4.7"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/25628"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.ubuntu.com/usn/usn-566-1"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2007/3156"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2008/0924/references"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2008/2821"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "https://issues.rpath.com/browse/RPL-1706"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://docs.info.apple.com/article.html?artnum=307562"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/27399"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/29420"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/30249"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/31575"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/32241"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securityreason.com/securityalert/3126"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.debian.org/security/2008/dsa-1576"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openssh.com/txt/release-4.7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/25628"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/usn-566-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2007/3156"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2008/0924/references"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2008/2821"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://issues.rpath.com/browse/RPL-1706"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vendorComments": [
          {
            "comment": "This issue did not affect the OpenSSH packages as distributed with Red Hat Enterprise Linux 2.1 or 3, as they do not support Trusted X11 forwarding.\n\nFor Red Hat Enterprise Linux 4 and 5, this issue was addressed via: https://rhn.redhat.com/errata/RHSA-2008-0855.html\n",
            "lastModified": "2008-08-28T00:00:00",
            "organization": "Red Hat"
          }
        ],
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T13:18:56+00:00",
      "cve": "CVE-2007-4752",
      "id": "CVE-2007-4752",
      "initial_release_date": "2007-09-04T00:00:00+00:00",
      "product_status:fixed": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssh falls back to the trusted x11 cookie if generation of an untrusted cookie fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2007/cve-2007-4752.json",
      "version": "3"
    }
  }
}

BDU:2015-09602 (CVE-2007-4752)

Vulnerability from fstec – Published: 2015-04-28 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость операционной системы Gentoo Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость пакета openssh (до версии 4.7) операционной системы Gentoo Linux, эксплуатация которой может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимости может быть осуществлена удаленно

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:P/A:P

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2007-4752, GLSA-200711-02

References

1 reference

URL
http://security.gentoo.org/glsa/glsa-200711-02.xml

Impacted products

1 product from 1 vendor

Vendors

Gentoo Foundation Inc.

Products

Gentoo Linux

Versions

до 2008.0 (Gentoo Linux)

Product types

Operating system

Mitigations

Обновление пакета openssh до версии 4.7 или выше

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Gentoo Foundation Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2008.0 (Gentoo Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 openssh \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 4.7 \u0438\u043b\u0438 \u0432\u044b\u0448\u0435",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "01.11.2007",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-09602",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2007-4752, GLSA-200711-02",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Gentoo Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gentoo Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 openssh (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 4.7) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gentoo Linux, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://security.gentoo.org/glsa/glsa-200711-02.xml",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CERTA-2007-AVI-497

Vulnerability from certfr_avis - Published: 2007-11-14 - Updated: 2007-11-14

None

Description

Une vulnérabilité de OpenSSH due à une erreur dans l'utilisation des cookies X11 permet à une personne malintentionnée distante d'élever ses privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	OpenSSH	N/A	OpenSSH versions antérieures à 4.7.

References

Title

Publication Time

Tags

Mise à jour 4.7 de OpenSSH du 04 septembre 2007	None	vendor-advisory
Liste des changements de OpenSSH 4.7 :	-	other
Bulletin de sécurité SUSE-SE:2007:022 du 26 octobre 2007 :	-	other
Bulletin de sécurité Gentoo GLSA 200711-02 du 01 novembre 2007 :	-	other
Mise à jour de HP-UX Secure Shell :	-	other
Bulletin de sécurité Fedora du 15 octobre 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSH versions ant\u00e9rieures \u00e0 4.7.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSH",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 de OpenSSH due \u00e0 une erreur dans l\u0027utilisation des\ncookies X11 permet \u00e0 une personne malintentionn\u00e9e distante d\u0027\u00e9lever ses\nprivil\u00e8ges.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-4752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4752"
    }
  ],
  "initial_release_date": "2007-11-14T00:00:00",
  "last_revision_date": "2007-11-14T00:00:00",
  "links": [
    {
      "title": "Liste des changements de OpenSSH 4.7 :",
      "url": "http://www.openssh.com/txt/release-4.7"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE-SE:2007:022 du 26 octobre 2007 :",
      "url": "http://www.novell.com/linux/security/advisories/2007_22_sr.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200711-02 du 01 novembre    2007 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200711-02.xml"
    },
    {
      "title": "Mise \u00e0 jour de HP-UX Secure Shell :",
      "url": "http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Fedora du 15 octobre 2007 :",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
    }
  ],
  "reference": "CERTA-2007-AVI-497",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-11-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSH",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Mise \u00e0 jour 4.7 de OpenSSH du 04 septembre 2007",
      "url": null
    }
  ]
}

CERTA-2008-AVI-148

Vulnerability from certfr_avis - Published: 2008-03-19 - Updated: 2008-03-19

None

Description

De multiples vulnérabilités ont été découvertes dans le système d'exploitation Apple Mac OS X. L'exploitation de ces vulnérabilités permet à un individu malveillant diverses actions dont exécuter du code arbitaire à distance, effectuer un déni de service, contourner la politique de sécurité, élever ses privilèges et effectuer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité Apple 307562 pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Apple	N/A	Apple Mac Os X version 10.4.11 et antérieures ;
	Apple	N/A	Apple Mac Os X version 10.5.2 et antérieures.

References

Title

Publication Time

Tags

Bulletin de sécurité Apple 307562 du 18 mars 2008

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apple Mac Os X version 10.4.11 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac Os X version 10.5.2 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le syst\u00e8me\nd\u0027exploitation Apple Mac OS X. L\u0027exploitation de ces vuln\u00e9rabilit\u00e9s\npermet \u00e0 un individu malveillant diverses actions dont ex\u00e9cuter du code\narbitaire \u00e0 distance, effectuer un d\u00e9ni de service, contourner la\npolitique de s\u00e9curit\u00e9, \u00e9lever ses privil\u00e8ges et effectuer une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Apple 307562 pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-0063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0063"
    },
    {
      "name": "CVE-2008-0060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0060"
    },
    {
      "name": "CVE-2007-3847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3847"
    },
    {
      "name": "CVE-2007-6109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6109"
    },
    {
      "name": "CVE-2007-1661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1661"
    },
    {
      "name": "CVE-2008-0882",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0882"
    },
    {
      "name": "CVE-2007-6336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6336"
    },
    {
      "name": "CVE-2007-2799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2799"
    },
    {
      "name": "CVE-2006-3747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3747"
    },
    {
      "name": "CVE-2007-5000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5000"
    },
    {
      "name": "CVE-2008-1089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-1089"
    },
    {
      "name": "CVE-2008-0005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0005"
    },
    {
      "name": "CVE-2007-4768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4768"
    },
    {
      "name": "CVE-2008-0059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0059"
    },
    {
      "name": "CVE-2008-1000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-1000"
    },
    {
      "name": "CVE-2007-1660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1660"
    },
    {
      "name": "CVE-2007-4568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4568"
    },
    {
      "name": "CVE-2007-3378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3378"
    },
    {
      "name": "CVE-2008-0052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0052"
    },
    {
      "name": "CVE-2008-0990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0990"
    },
    {
      "name": "CVE-2008-0995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0995"
    },
    {
      "name": "CVE-2007-0898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0898"
    },
    {
      "name": "CVE-2007-5266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5266"
    },
    {
      "name": "CVE-2008-0055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0055"
    },
    {
      "name": "CVE-2007-1997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1997"
    },
    {
      "name": "CVE-2007-1659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1659"
    },
    {
      "name": "CVE-2007-6337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6337"
    },
    {
      "name": "CVE-2008-0044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0044"
    },
    {
      "name": "CVE-2008-0045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0045"
    },
    {
      "name": "CVE-2007-5971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5971"
    },
    {
      "name": "CVE-2008-0046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0046"
    },
    {
      "name": "CVE-2008-0047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0047"
    },
    {
      "name": "CVE-2007-6335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6335"
    },
    {
      "name": "CVE-2007-5267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5267"
    },
    {
      "name": "CVE-2007-3725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3725"
    },
    {
      "name": "CVE-2008-0054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0054"
    },
    {
      "name": "CVE-2008-0996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0996"
    },
    {
      "name": "CVE-2007-5268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5268"
    },
    {
      "name": "CVE-2007-6203",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6203"
    },
    {
      "name": "CVE-2008-0051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0051"
    },
    {
      "name": "CVE-2007-3799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-3799"
    },
    {
      "name": "CVE-2008-0048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0048"
    },
    {
      "name": "CVE-2007-1662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1662"
    },
    {
      "name": "CVE-2006-3334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3334"
    },
    {
      "name": "CVE-2008-0998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0998"
    },
    {
      "name": "CVE-2007-0897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0897"
    },
    {
      "name": "CVE-2008-0318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0318"
    },
    {
      "name": "CVE-2007-6429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6429"
    },
    {
      "name": "CVE-2007-4510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4510"
    },
    {
      "name": "CVE-2007-5269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5269"
    },
    {
      "name": "CVE-2007-5795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5795"
    },
    {
      "name": "CVE-2008-0006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0006"
    },
    {
      "name": "CVE-2008-0062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0062"
    },
    {
      "name": "CVE-2008-0728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0728"
    },
    {
      "name": "CVE-2007-2445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-2445"
    },
    {
      "name": "CVE-2008-0049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0049"
    },
    {
      "name": "CVE-2007-1745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1745"
    },
    {
      "name": "CVE-2007-6427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6427"
    },
    {
      "name": "CVE-2008-0987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0987"
    },
    {
      "name": "CVE-2008-0993",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0993"
    },
    {
      "name": "CVE-2008-0988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0988"
    },
    {
      "name": "CVE-2008-0056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0056"
    },
    {
      "name": "CVE-2008-0992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0992"
    },
    {
      "name": "CVE-2006-5793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5793"
    },
    {
      "name": "CVE-2007-6428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6428"
    },
    {
      "name": "CVE-2008-0989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0989"
    },
    {
      "name": "CVE-2005-3352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-3352"
    },
    {
      "name": "CVE-2008-0053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0053"
    },
    {
      "name": "CVE-2007-4767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4767"
    },
    {
      "name": "CVE-2008-0050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0050"
    },
    {
      "name": "CVE-2007-5958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-5958"
    },
    {
      "name": "CVE-2006-6481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6481"
    },
    {
      "name": "CVE-2008-0994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0994"
    },
    {
      "name": "CVE-2007-6421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6421"
    },
    {
      "name": "CVE-2008-0058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0058"
    },
    {
      "name": "CVE-2007-4752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4752"
    },
    {
      "name": "CVE-2008-0999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0999"
    },
    {
      "name": "CVE-2007-4560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4560"
    },
    {
      "name": "CVE-2007-4990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4990"
    },
    {
      "name": "CVE-2007-4766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4766"
    },
    {
      "name": "CVE-2007-6388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-6388"
    },
    {
      "name": "CVE-2008-0596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0596"
    },
    {
      "name": "CVE-2007-4887",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4887"
    }
  ],
  "initial_release_date": "2008-03-19T00:00:00",
  "last_revision_date": "2008-03-19T00:00:00",
  "links": [],
  "reference": "CERTA-2008-AVI-148",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-03-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": null,
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple Mac OS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 307562 du 18 mars 2008",
      "url": "http://docs.info.apple.com/article.html?artnum=307562"
    }
  ]
}

CERTA-2008-AVI-428

Vulnerability from certfr_avis - Published: 2008-08-22 - Updated: 2008-08-29

None

Description

Certains serveurs concernant la distribution de paquets pour Red Hat auraient été compromis. Il est possible que certaines mises à jour, en particulier concernant OpenSSH, ne soient pas correctes. Aucune information sur la date de compromission n'est à ce jour connue.

Red Hat publie avec une nouvelle signature les paquets OpenSSH qui corrigent la vulnérabilité CVE-2007-4752 décrite dans l'avis CERTA-2007-AVI-497.

Un script est également fourni afin de tester sur les systèmes les versions installées. Il indique, en s'appuyant sur une liste noire de signatures pas nécessairement exhaustive, si des versions frauduleuses sont présentes.

Solution

Se référer au bulletin de sécurité RHSA-2008-0855 de Red Hat pour l'obtention des correctifs (cf. section Documentation).

Certains paquets de mises à jour OpenSSH distribués pour Red Hat Desktop et Red Hat Enterprise.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Annonce de sécurité Red Hat RHSA-2008:0855-6 du 22 août 2008	None	vendor-advisory
Script de test fourni par Red Hat :	-	other
Bulletin de sécurité RedHat RHSA-2008:0855 du 22 août 2008 :	-	other
Avis de sécurité CERTA-2007-AVI-497 du 14 novembre 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eCertains paquets de mises \u00e0 jour OpenSSH distribu\u00e9s pour Red  Hat Desktop et Red Hat Enterprise.\u003c/P\u003e",
  "content": "## Description\n\nCertains serveurs concernant la distribution de paquets pour Red Hat\nauraient \u00e9t\u00e9 compromis. Il est possible que certaines mises \u00e0 jour, en\nparticulier concernant OpenSSH, ne soient pas correctes. Aucune\ninformation sur la date de compromission n\u0027est \u00e0 ce jour connue.\n\nRed Hat publie avec une nouvelle signature les paquets OpenSSH qui\ncorrigent la vuln\u00e9rabilit\u00e9 CVE-2007-4752 d\u00e9crite dans l\u0027avis\nCERTA-2007-AVI-497.\n\nUn script est \u00e9galement fourni afin de tester sur les syst\u00e8mes les\nversions install\u00e9es. Il indique, en s\u0027appuyant sur une liste noire de\nsignatures pas n\u00e9cessairement exhaustive, si des versions frauduleuses\nsont pr\u00e9sentes.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 RHSA-2008-0855 de Red Hat pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-3844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3844"
    },
    {
      "name": "CVE-2007-4752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-4752"
    }
  ],
  "initial_release_date": "2008-08-22T00:00:00",
  "last_revision_date": "2008-08-29T00:00:00",
  "links": [
    {
      "title": "Script de test fourni par Red Hat :",
      "url": "http://www.redhat.com/security/data/openssh-blacklist.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2008:0855 du 22 ao\u00fbt 2008    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0855.html"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 CERTA-2007-AVI-497 du 14 novembre 2007 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2007-AVI-497/"
    }
  ],
  "reference": "CERTA-2008-AVI-428",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-08-22T00:00:00.000000"
    },
    {
      "description": "ajout du CVE sp\u00e9cifique pour l\u0027incident.",
      "revision_date": "2008-08-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9s dans des mises \u00e0 jour d\u0027OpenSSH sous Red Hat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de s\u00e9curit\u00e9 Red Hat RHSA-2008:0855-6 du 22 ao\u00fbt 2008",
      "url": null
    }
  ]
}

FKIE_CVE-2007-4752

Vulnerability from fkie_nvd - Published: 2007-09-12 01:17 - Updated: 2026-06-16 22:44

Severity

Summary

References

URL	Tags
cve@mitre.org	http://bugs.gentoo.org/show_bug.cgi?id=191321
cve@mitre.org	http://docs.info.apple.com/article.html?artnum=307562
cve@mitre.org	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085
cve@mitre.org	http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
cve@mitre.org	http://secunia.com/advisories/27399
cve@mitre.org	http://secunia.com/advisories/29420
cve@mitre.org	http://secunia.com/advisories/30249
cve@mitre.org	http://secunia.com/advisories/31575
cve@mitre.org	http://secunia.com/advisories/32241
cve@mitre.org	http://security.gentoo.org/glsa/glsa-200711-02.xml
cve@mitre.org	http://securityreason.com/securityalert/3126
cve@mitre.org	http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm
cve@mitre.org	http://www.debian.org/security/2008/dsa-1576
cve@mitre.org	http://www.mandriva.com/security/advisories?name=MDKSA-2007:236
cve@mitre.org	http://www.openssh.com/txt/release-4.7
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2008-0855.html
cve@mitre.org	http://www.securityfocus.com/archive/1/479760/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/archive/1/483748/100/200/threaded
cve@mitre.org	http://www.securityfocus.com/bid/25628
cve@mitre.org	http://www.ubuntu.com/usn/usn-566-1
cve@mitre.org	http://www.vupen.com/english/advisories/2007/3156
cve@mitre.org	http://www.vupen.com/english/advisories/2008/0924/references
cve@mitre.org	http://www.vupen.com/english/advisories/2008/2821
cve@mitre.org	https://bugzilla.redhat.com/show_bug.cgi?id=280471
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/36637
cve@mitre.org	https://issues.rpath.com/browse/RPL-1706	Patch
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599
cve@mitre.org	https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html
af854a3a-2127-422b-91ae-364da2661108	http://bugs.gentoo.org/show_bug.cgi?id=191321
af854a3a-2127-422b-91ae-364da2661108	http://docs.info.apple.com/article.html?artnum=307562
af854a3a-2127-422b-91ae-364da2661108	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085
af854a3a-2127-422b-91ae-364da2661108	http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/27399
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/29420
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/30249
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/31575
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/32241
af854a3a-2127-422b-91ae-364da2661108	http://security.gentoo.org/glsa/glsa-200711-02.xml
af854a3a-2127-422b-91ae-364da2661108	http://securityreason.com/securityalert/3126
af854a3a-2127-422b-91ae-364da2661108	http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2008/dsa-1576
af854a3a-2127-422b-91ae-364da2661108	http://www.mandriva.com/security/advisories?name=MDKSA-2007:236
af854a3a-2127-422b-91ae-364da2661108	http://www.openssh.com/txt/release-4.7
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2008-0855.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/479760/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/483748/100/200/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/25628
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/usn-566-1
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2007/3156
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2008/0924/references
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2008/2821
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=280471
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/36637
af854a3a-2127-422b-91ae-364da2661108	https://issues.rpath.com/browse/RPL-1706	Patch
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html

Impacted products

Vendor	Product	Version
openbsd	openssh	*
openbsd	openssh	4.0
openbsd	openssh	4.0p1
openbsd	openssh	4.1
openbsd	openssh	4.1p1
openbsd	openssh	4.2
openbsd	openssh	4.2p1
openbsd	openssh	4.3
openbsd	openssh	4.3p1
openbsd	openssh	4.3p2
openbsd	openssh	4.4
openbsd	openssh	4.4p1
openbsd	openssh	4.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A410C8F9-717C-4657-91DD-BAEAB53ECC16",
              "versionEndIncluding": "4.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E003AB3C-8DF3-4AE8-82A3-984F30E5599B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.0p1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EBE75FE-DDE2-43BA-80EF-15A6698EABC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FF67D77-02AC-4807-984D-C5AE9799F051",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.1p1:*:*:*:*:*:*:*",
              "matchCriteriaId": "683B26F0-5EA2-455A-8948-27C100BBA3AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5A75B23-2DD7-4EB2-BEAA-049FF4E51A14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.2p1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7279E1EC-DEBC-4ACC-925D-06A7697C162F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7910598E-BEC1-4644-9DE4-D8BE505A4F9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.3p1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB416D0C-6C86-450F-8917-D4B1BD82AB1E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.3p2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3640CCC9-EC4A-44A4-B747-7BAAAD3460C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2DD362E-9EA9-4E88-9A94-D7B471EB1FD4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.4p1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3094069-AC2E-43BD-8094-D48E2526DECC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B72CFB3-39C7-469C-AA59-69F5B8993BF7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted."
    },
    {
      "lang": "es",
      "value": "ssh en OpenSSH anterior a 4.7 no maneja adecuadamente cuando una cookie no confiable no puede ser creada y utiliza una cookie X11 confiable en su lugar, lo cual permite a los atacantes violar pol\u00edticas establecidas y obtener privilegios provocando que un cliente X sea tratado como confiable."
    }
  ],
  "id": "CVE-2007-4752",
  "lastModified": "2026-06-16T22:44:42.657",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-09-12T01:17:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://docs.info.apple.com/article.html?artnum=307562"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27399"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29420"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/30249"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/31575"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32241"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3126"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2008/dsa-1576"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openssh.com/txt/release-4.7"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/25628"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-566-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/3156"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0924/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/2821"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://issues.rpath.com/browse/RPL-1706"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://docs.info.apple.com/article.html?artnum=307562"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27399"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29420"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/30249"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/31575"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32241"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3126"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2008/dsa-1576"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openssh.com/txt/release-4.7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/25628"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-566-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/3156"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0924/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/2821"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://issues.rpath.com/browse/RPL-1706"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "This issue did not affect the OpenSSH packages as distributed with Red Hat Enterprise Linux 2.1 or 3, as they do not support Trusted X11 forwarding.\n\nFor Red Hat Enterprise Linux 4 and 5, this issue was addressed via: https://rhn.redhat.com/errata/RHSA-2008-0855.html\n",
      "lastModified": "2008-08-28T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-657X-XG3W-FXX6

Vulnerability from github – Published: 2022-05-01 18:26 – Updated: 2022-05-01 18:26

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2007-4752"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-09-12T01:17:00Z",
    "severity": "HIGH"
  },
  "details": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.",
  "id": "GHSA-657x-xg3w-fxx6",
  "modified": "2022-05-01T18:26:55Z",
  "published": "2022-05-01T18:26:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4752"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
    },
    {
      "type": "WEB",
      "url": "https://issues.rpath.com/browse/RPL-1706"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
    },
    {
      "type": "WEB",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
    },
    {
      "type": "WEB",
      "url": "http://docs.info.apple.com/article.html?artnum=307562"
    },
    {
      "type": "WEB",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/27399"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/29420"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30249"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/31575"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32241"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3126"
    },
    {
      "type": "WEB",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2008/dsa-1576"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
    },
    {
      "type": "WEB",
      "url": "http://www.openssh.com/txt/release-4.7"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/25628"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/usn-566-1"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/3156"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/0924/references"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/2821"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2007-4752

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2007-4752

Aliases

CVE-2007-4752

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2007-4752",
    "description": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.",
    "id": "GSD-2007-4752",
    "references": [
      "https://www.suse.com/security/cve/CVE-2007-4752.html",
      "https://access.redhat.com/errata/RHSA-2008:0855",
      "https://linux.oracle.com/cve/CVE-2007-4752.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2007-4752"
      ],
      "details": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.",
      "id": "GSD-2007-4752",
      "modified": "2023-12-13T01:21:36.178839Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2007-4752",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.openssh.com/txt/release-4.7",
            "refsource": "CONFIRM",
            "url": "http://www.openssh.com/txt/release-4.7"
          },
          {
            "name": "GLSA-200711-02",
            "refsource": "GENTOO",
            "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
          },
          {
            "name": "oval:org.mitre.oval:def:10809",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
          },
          {
            "name": "DSA-1576",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2008/dsa-1576"
          },
          {
            "name": "25628",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/25628"
          },
          {
            "name": "20070917 FLEA-2007-0055-1 openssh openssh-client openssh-server gnome-ssh-askpass",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
          },
          {
            "name": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
            "refsource": "CONFIRM",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
          },
          {
            "name": "FEDORA-2007-715",
            "refsource": "FEDORA",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
          },
          {
            "name": "USN-566-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/usn-566-1"
          },
          {
            "name": "3126",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/3126"
          },
          {
            "name": "ADV-2008-0924",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2008/0924/references"
          },
          {
            "name": "ADV-2008-2821",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2008/2821"
          },
          {
            "name": "30249",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/30249"
          },
          {
            "name": "ADV-2007-3156",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2007/3156"
          },
          {
            "name": "SSRT071485",
            "refsource": "HP",
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
          },
          {
            "name": "31575",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/31575"
          },
          {
            "name": "RHSA-2008:0855",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
          },
          {
            "name": "MDKSA-2007:236",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
          },
          {
            "name": "oval:org.mitre.oval:def:5599",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=280471",
            "refsource": "MISC",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
          },
          {
            "name": "29420",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/29420"
          },
          {
            "name": "APPLE-SA-2008-03-18",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
          },
          {
            "name": "20071115 Re: HPSBUX02287 SSRT071485 rev.1 - HP-UX Running HP Secure Shell, Remotely Gain Extended Privileges",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
          },
          {
            "name": "HPSBUX02287",
            "refsource": "HP",
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
          },
          {
            "name": "27399",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/27399"
          },
          {
            "name": "openssh-x11cookie-privilege-escalation(36637)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
          },
          {
            "name": "https://issues.rpath.com/browse/RPL-1706",
            "refsource": "CONFIRM",
            "url": "https://issues.rpath.com/browse/RPL-1706"
          },
          {
            "name": "http://docs.info.apple.com/article.html?artnum=307562",
            "refsource": "CONFIRM",
            "url": "http://docs.info.apple.com/article.html?artnum=307562"
          },
          {
            "name": "http://bugs.gentoo.org/show_bug.cgi?id=191321",
            "refsource": "CONFIRM",
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
          },
          {
            "name": "SUSE-SR:2007:022",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
          },
          {
            "name": "32241",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/32241"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.3p2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.3p1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.2p1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.4p1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.0p1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.6",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:openbsd:openssh:4.1p1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-4752"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.openssh.com/txt/release-4.7",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.openssh.com/txt/release-4.7"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-1706",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "https://issues.rpath.com/browse/RPL-1706"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=280471",
              "refsource": "MISC",
              "tags": [],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=280471"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=191321",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=191321"
            },
            {
              "name": "FEDORA-2007-715",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00214.html"
            },
            {
              "name": "GLSA-200711-02",
              "refsource": "GENTOO",
              "tags": [],
              "url": "http://security.gentoo.org/glsa/glsa-200711-02.xml"
            },
            {
              "name": "MDKSA-2007:236",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:236"
            },
            {
              "name": "SUSE-SR:2007:022",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2007-10/msg00008.html"
            },
            {
              "name": "25628",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/25628"
            },
            {
              "name": "27399",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/27399"
            },
            {
              "name": "3126",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/3126"
            },
            {
              "name": "USN-566-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/usn-566-1"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=307562",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://docs.info.apple.com/article.html?artnum=307562"
            },
            {
              "name": "APPLE-SA-2008-03-18",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html"
            },
            {
              "name": "29420",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/29420"
            },
            {
              "name": "DSA-1576",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2008/dsa-1576"
            },
            {
              "name": "30249",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/30249"
            },
            {
              "name": "31575",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/31575"
            },
            {
              "name": "RHSA-2008:0855",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0855.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-399.htm"
            },
            {
              "name": "32241",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/32241"
            },
            {
              "name": "ADV-2008-2821",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2008/2821"
            },
            {
              "name": "ADV-2008-0924",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2008/0924/references"
            },
            {
              "name": "ADV-2007-3156",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2007/3156"
            },
            {
              "name": "SSRT071485",
              "refsource": "HP",
              "tags": [],
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01271085"
            },
            {
              "name": "openssh-x11cookie-privilege-escalation(36637)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36637"
            },
            {
              "name": "oval:org.mitre.oval:def:5599",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5599"
            },
            {
              "name": "oval:org.mitre.oval:def:10809",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10809"
            },
            {
              "name": "20071115 Re: HPSBUX02287 SSRT071485 rev.1 - HP-UX Running HP Secure Shell, Remotely Gain Extended Privileges",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/483748/100/200/threaded"
            },
            {
              "name": "20070917 FLEA-2007-0055-1 openssh openssh-client openssh-server gnome-ssh-askpass",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/479760/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": true,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-15T21:37Z",
      "publishedDate": "2007-09-12T01:17Z"
    }
  }
}

OPENSUSE-SU-2024:11124-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:12

Summary

openssh-8.4p1-7.4 on GA media

Severity

Moderate

Scope

12 vulnerabilities in this advisory, including CVE-2007-4752.

CVE-2007-4752

Recommended: 28 products

Open the full advisory

RHSA-2008:0855

Vulnerability from csaf_redhat - Published: 2008-08-22 12:10 - Updated: 2026-06-25 10:35

Summary

Red Hat Security Advisory: openssh security update

Severity

Critical

Scope

2 vulnerabilities in this advisory, including CVE-2007-4752.

CVE-2007-4752

Fixed: 181 products

https://access.redhat.com/errata/RHSA-2008:0855

Open the full advisory

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2007-4752 (GCVE-0-2007-4752)

BDU:2015-09602 (CVE-2007-4752)

Description

Solution

Description

Solution

Description

Solution

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour