Vulnerability Details : CVE-2012-0814
The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.
Threat overview for CVE-2012-0814
Top countries where our scanners detected CVE-2012-0814
Top open port discovered on systems with this issue
22
IPs affected by CVE-2012-0814 1,749,561
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2012-0814!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2012-0814
Probability of exploitation activity in the next 30 days: 0.29%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 64 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-0814
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:P/I:N/A:N |
6.8
|
2.9
|
NIST |
CWE ids for CVE-2012-0814
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-0814
-
http://openwall.com/lists/oss-security/2012/01/27/4
oss-security - Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients
-
http://openwall.com/lists/oss-security/2012/01/26/15
oss-security - CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients
-
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c
CVS log for src/usr.bin/ssh/auth-options.c
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/72756
Debian openssh-server commands information disclosure CVE-2012-0814 Vulnerability Report
-
http://openwall.com/lists/oss-security/2012/01/26/16
oss-security - Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445
#657445 - openssh-server: Forced Command handling leaks private information to ssh clients - Debian Bug report logs
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
Juniper Networks - 2015-04 Security Bulletin: IDP: Multiple vulnerabilities addressed by third party software updates.
-
http://openwall.com/lists/oss-security/2012/01/27/1
oss-security - Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients
-
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53%3Br2=1.54
410 Gone
-
http://www.securityfocus.com/bid/51702
Debian openssh-server Forced Command Handling Information Disclosure Vulnerability
Products affected by CVE-2012-0814
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.2.27:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.5:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.9:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.0p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.9p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.9p2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.9.9:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.0.2p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.3:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.3p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.0.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.2.2p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.2.3p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.6.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.4p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.7.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.6.1p2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2.9.9p2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.4:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.5:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.5p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.6:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.7.1p2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.7:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.9.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.8:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.8.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:3.9:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.0p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.1p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.2p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.3:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.3p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.6:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.3p2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.4:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.4p1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.7:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.8:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:4.9:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:5.4:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:5.3:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:5.5:*:*:*:*:*:*:*
- cpe:2.3:a:openbsd:openssh:5.0:*:*:*:*:*:*:*