PublicDateAtUSN: 2016-04-30
Candidate: CVE-2015-8325
PublicDate: 2016-05-01 01:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8325
 https://ubuntu.com/security/notices/USN-2966-1
Description:
 The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2,
 when the UseLogin feature is enabled and PAM is configured to read
 .pam_environment files in user home directories, allows local users to gain
 privileges by triggering a crafted environment for the /bin/login program,
 as demonstrated by an LD_PRELOAD environment variable.
Ubuntu-Description:
Notes:
 tyhicks> Ubuntu is not affected in the default configuration since
  UseLogin is disabled in sshd_config
Bugs:
Priority: low
Discovered-by: Shayan Sadigh
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_openssh:
 upstream: https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
upstream_openssh: released (1:7.2p2-3)
precise_openssh: released (1:5.9p1-5ubuntu1.9)
precise/esm_openssh: released (1:5.9p1-5ubuntu1.9)
trusty_openssh: released (1:6.6p1-2ubuntu2.7)
trusty/esm_openssh: released (1:6.6p1-2ubuntu2.7)
vivid/stable-phone-overlay_openssh: ignored (reached end-of-life)
vivid/ubuntu-core_openssh: ignored (reached end-of-life)
wily_openssh: released (1:6.9p1-2ubuntu0.2)
xenial_openssh: not-affected (1:7.2p2-3)
esm-infra/xenial_openssh: not-affected (1:7.2p2-3)
yakkety_openssh: not-affected (1:7.2p2-3)
zesty_openssh: not-affected (1:7.2p2-3)
devel_openssh: not-affected (1:7.2p2-3)