バナーによると、リモートホストは、OpenSSH ポータブルバージョン 3.6.1 または以降を実行しているようです。

そのようなバージョンには、攻撃者が、このサーバーの管理者によって設定されたアクセス管理をバイパスできるようにする、欠陥があります。

OpenSSH は、ユーザーキーファイル内のパターンを指定することで、所定のユーザーがログインできるホストのリストを制限できる機構を備えています（つまり、*.mynetwork.com により、ユーザーはローカルネットワークのみから接続します）。

ただし、OpenSSH がリバース DNS 探索を行う方法に欠陥があります。
攻撃者が、リバース探索を行う際に、数値 IP アドレスを送信するように DNS サーバーを設定すると、この機構が回避されることがあります。

According to its banner, the remote host appears to be running OpenSSH-portable version 3.6.1 or older.

There is a flaw in such version that could allow an attacker to bypass the access controls set by the administrator of this server.

OpenSSH features a mechanism that can restrict the list of hosts a given user can log from by specifying a pattern in the user key file (ie: *.mynetwork.com would let a user connect only from the local network).

However there is a flaw in the way OpenSSH does reverse DNS lookups.
If an attacker configures a DNS server to send a numeric IP address when a reverse lookup is performed, this mechanism could be circumvented.

Updated openssh packages that fix bugs in sshd are now available for Red Hat Enterprise Linux 3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

An arbitrary command execution flaw was discovered in the way scp copies files locally. It is possible for a local attacker to create a file with a carefully crafted name that could execute arbitrary commands as the user running scp to copy files locally.
(CVE-2006-0225)

The SSH daemon, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass 'from=' and 'user@host' address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address. (CVE-2003-0386)

The following issues have also been fixed in this update :

* If the sshd service was stopped using the sshd init script while the main sshd daemon was not running, the init script would kill other sshd processes, such as the running sessions. For example, this could happen when the 'service sshd stop' command was issued twice.

* When privilege separation was enabled, the last login message was printed only for the root user.

* The sshd daemon was sending messages to the system log from a signal handler when debug logging was enabled. This could cause a deadlock of the user's connection.

All users of openssh should upgrade to these updated packages, which resolve these issues.

根据其标题，远程主机似乎正在运行 OpenSSH 可移植版本 3.6.1 或更低版本。

此版本中存在的缺陷可允许攻击者绕过由此服务器的管理员设置的访问控制。

OpenSSH 具有可限制指定用户可登录的主机列表的机制，方法是指定用户密钥文件中的模式（即：*.mynetwork.com 会让用户仅从本地网络连接）。

然而，OpenSSH 处理反向 DNS 查找的方式中存在缺陷。
如果攻击者将 DNS 服务器配置为在执行反向查找时发送数字 IP 地址，则可避开此机制。

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

リモートホストで実行されているバージョンの SunSSH に情報漏洩脆弱性があります。SSH の仕様の設計上の欠陥により、中間攻撃者が、標準構成の SSH 保護接続から最大 32 ビットまでの平文を回収できることがあります。攻撃者はこれを悪用して、機密情報にアクセスすることがあります。

このバージョンの SunSSH はいくつかのその他の問題の影響も受けやすくなっていますが、Nessus はそれらの問題をテストしていないことに、注意してください。

遠端主機上安裝的 SunSSH 版本有資訊洩漏弱點。SSH 規格的設計瑕疵允許攔截式攻擊者在標準組態中從 SSH 受保護的連線復原多達 32 位元的純文字。攻擊者可惡意利用此弱點來存取敏感資訊。

請注意，此版本的 SunSSH 也容易發生其他多個問題，但 Nessus 並未測試這些問題。

远程主机上运行的 SunSSH 版本存在信息泄露漏洞。SSH 规范中的设计缺陷可允许中间人攻击者从标准配置的受 SSH 保护的连接中恢复多达 32 位的明文。攻击者可利用这一点获取敏感信息的访问权限。

请注意，此 SunSSH 版本也易于发生多个其他问题，但 Nessus 未对其进行测试。

Updated openssh packages that fix several security issues in sshd are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

Mark Dowd discovered a signal handler race condition in the OpenSSH sshd server. A remote attacker could possibly leverage this flaw to cause a denial of service (crash). (CVE-2006-5051) The OpenSSH project believes the likelihood of successful exploitation leading to arbitrary code execution appears remote. However, the Red Hat Security Response Team have not yet been able to verify this claim due to lack of upstream vulnerability information. We are therefore including a fix for this flaw and have rated it important security severity in the event our continued investigation finds this issue to be exploitable.

Tavis Ormandy of the Google Security Team discovered a denial of service bug in the OpenSSH sshd server. A remote attacker can send a specially crafted SSH-1 request to the server causing sshd to consume a large quantity of CPU resources. (CVE-2006-4924)

An arbitrary command execution flaw was discovered in the way scp copies files locally. It is possible for a local attacker to create a file with a carefully crafted name that could execute arbitrary commands as the user running scp to copy files locally.
(CVE-2006-0225)

The SSH daemon, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass 'from=' and 'user@host' address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address. (CVE-2003-0386)

All users of openssh should upgrade to these updated packages, which contain backported patches that resolve these issues.

According to its banner, the remote host appears to be running OpenSSH-portable version 3.6.1 or older and is affected by a flaw in such version that could allow an attacker to bypass the access controls set by the administrator of this server.

OpenSSH features a mechanism that can restrict the list of hosts a given user can log from by specifying a pattern in the user key file (ie: *.mynetwork.com would let a user connect only from the local network).

However there is a flaw in the way OpenSSH does reverse DNS lookups. If an attacker configures a DNS server to send a numeric IP address when a reverse lookup is performed, this mechanism could be circumvented.

ID	名稱	產品	系列	已發布	已更新	嚴重性
11712	OpenSSH < 3.6.2 リバース DNS 探索のバイパス	Nessus	Misc.	2003/6/10	2024/3/27	high
11712	OpenSSH < 3.6.2 Reverse DNS Lookup Bypass	Nessus	Misc.	2003/6/10	2024/3/27	high
22134	CentOS 3 : openssh (CESA-2006:0298)	Nessus	CentOS Local Security Checks	2006/8/4	2021/1/4	high
11712	OpenSSH < 3.6.2 反向 DNS 查找绕过	Nessus	Misc.	2003/6/10	2024/3/27	high
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	2011/8/29	2020/9/21	critical
55992	SunSSH < 1.1.1 / 1.3 CBC の平文での漏洩	Nessus	Misc.	2011/8/29	2020/9/21	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 純文字洩漏	Nessus	Misc.	2011/8/29	2020/9/21	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 明文泄露	Nessus	Misc.	2011/8/29	2020/9/21	critical
22084	RHEL 3 : openssh (RHSA-2006:0298)	Nessus	Red Hat Local Security Checks	2006/7/21	2021/1/14	high
22474	RHEL 2.1 : openssh (RHSA-2006:0698)	Nessus	Red Hat Local Security Checks	2006/9/29	2021/1/14	high
701171	OpenSSH < 3.6.2 Reverse DNS Lookup Bypass	Nessus Network Monitor	SSH	2019/8/21	2019/8/21	high

偵測

搜尋 Plugin

high

high

high

high

critical

critical

critical

critical

high

high

high