OSVDB ID: 22695 Title: LSH lshd Seed-file File Descriptor Leak |
Info |
|
|
Dates |
||||
|
|
Description |
LSH contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when LSH spawns a new shell for a user. This will leak file descriptors from the 'lshd' daemon to the new process, potentially allowing the user to obtain keying material from the random number generator seed file. This will result in a loss of confidentiality. In addition, the user could truncate that file, denying the 'lshd' daemon access to keying material, causing a Denial-of-Service condition. |
Classification |
Location:
Local Access Required
Attack Type: Denial of Service, Information Disclosure Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified |
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, the author has released a patch to address this vulnerability. |
Products |
|
References |
|
Credit |
|