Executive brief
A vulnerability in the SSH agent program allows local users on a shared system to steal the authentication credentials of other users. By gaining access to these credentials, an attacker can log into remote servers as the victim without needing their password. This could lead to unauthorized access to sensitive remote data and a complete compromise of the victim's remote accounts.
Technical details
The ssh-agent program, used for holding private keys for public key authentication, fails to sufficiently protect the communication socket or the credentials it manages. This flaw allows a local attacker on the same multi-user system to hijack the agent's functionality or access the stored credentials. By interacting with the vulnerable ssh-agent process, an attacker can authenticate to remote hosts as the victim user. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) and requires local access to the host where the agent is running.
Affected products
- SSH Communications Security SSH Agent
Timeline
- 1998-01-22: disclosed