OpenSSH Remote Code Execution (RegreSSHion) Vulnerability (CVE-2024-6387)

An OpenSSH Remote Code Execution (RegreSSHion) Vulnerability (CVE-2024-6387) was identified recently in OpenSSH server (sshd) and dubbed regreSSHion.  The vulnerability is known to be exploitable in the default configuration of Open SSH in specific version ranges running on 32-bit glibc-based Linux systems, and allows an unauthenticated attacker to execute arbitrary code on the affected systems with root privileges.

Vulnerability

• OpenSSH Remote Code Execution (RegreSSHion) Vulnerability (CVE-2024-6387)

Severity Level

• High

Affected Products

• Open SSH version earlier than 4.4p1, unless they are patched for CVE-2006-5051 and CVE-2008-4109
• OpenSSH versions 8.5p1 up to but not including 9.8p1

Remediation

• Update to the latest patch of OpenSSH immediately.
• Limit the access control of SSH.

Reference

• Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability (paloaltonetworks.com)
• CVE-2024-6387 aka regreSSHion – root cause, risks, mitigation (kaspersky.com)
• regreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server | Qualys Security Blog
• CVE-2024-6387 Common Vulnerabilities and Exposures | SUSE
• CVE-2024-6387 | Ubuntu

Enquiry

• For enquiries, please contact infosec@cuhk.edu.hk. Thanks a lot.

Published on: 03 Jul 2024