CVE-2014-9278
Last modified
CVE-2014-9278 is a vulnerability of currently unknown severity. The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.. EPSS estimates a 1.83% chance of exploitation in the next 30 days.
Description
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openbsd | Openssh | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-9278?
How severe is CVE-2014-9278?
How do I fix CVE-2014-9278?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-9272The string_insert_href function in MantisBT 1.2.0a1 through …
- CVE-2014-9273lib/handle.c in Hivex before 1.3.11 allows local users to ex…
- CVE-2014-9274UnRTF allows remote attackers to cause a denial of service (…
- CVE-2014-9275UnRTF allows remote attackers to cause a denial of service (…
- CVE-2014-9276Cross-site request forgery (CSRF) vulnerability in the Speci…
- CVE-2014-9277The wfMangleFlashPolicy function in OutputHandler.php in Med…
- CVE-2014-9279The print_test_result function in admin/upgrade_unattended.p…
- CVE-2014-9280The current_user_get_bug_filter function in core/current_use…
- CVE-2014-9281Cross-site scripting (XSS) vulnerability in admin/copy_field…
- CVE-2014-9282Directory traversal vulnerability in the Speed Root Explorer…
- CVE-2014-9283The BestWebSoft Captcha plugin before 4.0.7 for WordPress al…
- CVE-2014-9284The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 an…
Are you affected by CVE-2014-9278?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST