Description:

CVE-2024-6409 is a race condition vulnerability in OpenSSH's server (sshd) that could allow an unauthenticated remote attacker to execute code as an unprivileged user running the sshd server. The vulnerability arises when a remote attacker fails to authenticate within a specific time frame, triggering sshd's SIGALRM handler asynchronously. This handler calls functions that are not async-signal-safe, such as syslog(), potentially leading to remote code execution.

Key Insights:

• High Severity: Despite a CVSS score of 7, SOCRadar's SVRS assigns a score of 40, indicating a moderate level of urgency.
• Active Exploitation: The vulnerability is actively exploited in the wild, highlighting the need for immediate action.
• Unprivileged Access: Successful exploitation grants attackers unprivileged access to the system running the sshd server.
• Remote Code Execution: In the worst-case scenario, attackers could execute arbitrary code on the vulnerable system.

Mitigation Strategies:

• Update OpenSSH: Install the latest version of OpenSSH (9.2p1) or later, which addresses this vulnerability.
• Disable SIGALRM: Disable the SIGALRM signal handler in sshd's configuration file (/etc/ssh/sshd_config) by setting "UseDNS no" and "GSSAPIAuthentication no."
• Limit Access: Restrict access to the sshd service to trusted hosts and users.
• Monitor Logs: Regularly monitor system logs for suspicious activity, such as failed authentication attempts or unusual system behavior.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.