sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1552 advisory.

    - prevent a server from skipping SSHFP lookup (#1081338) CVE-2014-2653
    - ignore environment variables with embedded '=' or '\0' characters CVE-2014-2532

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that OpenSSH clients did not correctly verify DNS SSHFP records. A malicious server could use this flaw to force a connecting client to skip the DNS SSHFP record check and require the user to perform manual host verification of the DNS SSHFP record.
(CVE-2014-2653)

It was found that OpenSSH did not properly handle certain AcceptEnv parameter values with wildcard characters. A remote attacker could use this flaw to bypass intended environment variable restrictions.
(CVE-2014-2532)

This update also fixes the following bugs :

  - Based on the SP800-131A information security standard,     the generation of a digital signature using the Digital     Signature Algorithm (DSA) with the key size of 1024 bits     and RSA with the key size of less than 2048 bits is     disallowed after the year 2013. After this update,     ssh-keygen no longer generates keys with less than 2048     bits in FIPS mode. However, the sshd service accepts     keys of size 1024 bits as well as larger keys for     compatibility reasons.

  - Previously, the openssh utility incorrectly set the     oom_adj value to -17 for all of its children processes.
    This behavior was incorrect because the children     processes were supposed to have this value set to 0.
    This update applies a patch to fix this bug and oom_adj     is now properly set to 0 for all children processes as     expected.

  - Previously, if the sshd service failed to verify the     checksum of an installed FIPS module using the fipscheck     library, the information about this failure was only     provided at the standard error output of sshd. As a     consequence, the user could not notice this message and     be uninformed when a system had not been properly     configured for FIPS mode. To fix this bug, this behavior     has been changed and sshd now sends such messages via     the syslog service.

  - When keys provided by the pkcs11 library were removed     from the ssh agent using the 'ssh-add -e' command, the     user was prompted to enter a PIN. With this update, a     patch has been applied to allow the user to remove the     keys provided by pkcs11 without the PIN.

In addition, this update adds the following enhancements :

  - With this update, ControlPersist has been added to     OpenSSH. The option in conjunction with the     ControlMaster configuration directive specifies that the     master connection remains open in the background after     the initial client connection has been closed.

  - When the sshd daemon is configured to force the internal     SFTP session, and the user attempts to use a connection     other than SFTP, the appropriate message is logged to     the /var/log/secure file.

  - Support for Elliptic Curve Cryptography modes for key     exchange (ECDH) and host user keys (ECDSA) as specified     by RFC5656 has been added to the openssh packages.
    However, they are not enabled by default and the user     has to enable them manually.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1419 advisory.

    This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.6. It addresses 32 CVEs:
    CVE-2025-26465, CVE-2016-1908, CVE-2014-2532, CVE-2026-35388, CVE-2023-48795, and 27 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSH running on the remote host is affected by multiple security bypass vulnerabilities :

  - sshd in OpenSSH versions before 6.6 do not properly     support wildcards on AcceptEnv lines in sshd_config,     which allow a remote attacker to bypass intended     environment restrictions by using a substring located     before a wildcard character. (CVE-2014-2532)

  - The verify_host_key function in sshconnect.c in the     OpenSSH client for versions 6.6 and earlier allows     remote servers to trigger the skipping of SSHFP DNS     checking by presenting an unacceptable HostCertificate.
    (CVE-2014-2653)

CVE-2014-2653 The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

CVE-2014-2532 sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssh packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0470 advisory.

    This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.2. It addresses 21 CVEs:
    CVE-2006-4924, CVE-2023-51385, CVE-2016-6210, CVE-2016-1908, CVE-2023-48795, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
78312	Amazon Linux AMI : openssh (ALAS-2014-369)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
78526	Oracle Linux 6 : openssh (ELSA-2014-1552)	Nessus	Oracle Linux Local Security Checks	2014/10/17	2025/2/18	medium
78641	Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20141014)	Nessus	Scientific Linux Local Security Checks	2014/10/23	2021/1/14	medium
356390	Rocky Linux 9.6 [CIQ] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ciqsa-2026_1419)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
76168	AIX OpenSSH Vulnerability : openssh_advisory4.asc	Nessus	AIX Local Security Checks	2014/6/20	2023/4/21	medium
91617	F5 Networks BIG-IP : OpenSSH vulnerabilities (K15780)	Nessus	F5 Networks Local Security Checks	2016/6/15	2026/10/21	medium
127206	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssh Multiple Vulnerabilities (NS-SA-2019-0036)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/8	high
354271	Rocky Linux 9.2 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0470)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

偵測

搜尋 Plugin

medium

medium

medium

critical

medium

medium

high

critical