Remote Unauthenticated Code Execution in OpenSSH Server

Qualys discovered a Remote Unauthenticated Code Execution (RCE) vulnerability, named regreSSHion, in OpenSSH's server affecting glibc-based Linux systems. This flaw allows unauthenticated remote code execution as root, posing a significant security risk. Over 14 million OpenSSH server instances are potentially vulnerable, with approximately 700,000 exposed to the internet. The vulnerability is a regression of a previously patched issue, emphasizing the importance of thorough regression testing. Qualys developed an exploit but will not release it immediately to allow time for patches. The impact of exploitation includes full system compromise, data manipulation, and network propagation. Mitigation steps involve patch management, enhanced access control, and network segmentation. Qualys offers tools like Vulnerability Management, Detection, and Response (VMDR) to address the risk effectively. Users are advised to patch urgently and monitor for exploitation attempts. The vulnerability affects Linux systems running specific versions of OpenSSH, while its impact on macOS and Windows remains uncertain.