Updated OpenSSH packages are now available that fix bugs that may be remotely exploitable.

[Updated 17 Sep 2003] Updated packages are now available to fix additional buffer manipulation problems which were fixed in OpenSSH 3.7.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0695 to these additional issues.

We have also included fixes from Solar Designer for some additional memory bugs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0682 to these issues.

OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login sessions and port forwarding, among other functions.

The OpenSSH team has announced a bug which affects the OpenSSH buffer handling code. This bug has the potential of being remotely exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0693 to this issue.

All users of OpenSSH should immediately apply this update which contains a backported fix for this issue.

Several bugs have been found in OpenSSH's buffer handling. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

DSA-383-2: This advisory is an addition to the earlier DSA-383-1 advisory: Solar Designer found four more bugs in OpenSSH that may be exploitable.

A buffer management error was discovered in all versions of openssh prior to version 3.7. According to the OpenSSH team's advisory: 'It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs fixed proactively.' There have also been reports of an exploit in the wild.

MandrakeSoft encourages all users to upgrade to these patched openssh packages immediately and to disable sshd until you are able to upgrade if at all possible.

Update :

The OpenSSH developers discovered more, similar, problems and revised the patch to correct these issues. These new packages have the latest patch fix applied.

遠端主機上安裝的 SunSSH 版本有資訊洩漏弱點。SSH 規格的設計瑕疵允許攔截式攻擊者在標準組態中從 SSH 受保護的連線復原多達 32 位元的純文字。攻擊者可惡意利用此弱點來存取敏感資訊。

請注意，此版本的 SunSSH 也容易發生其他多個問題，但 Nessus 並未測試這些問題。

According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1.  Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH.  Since Nessus solely relied on the banner of the remote SSH server to perform this check, this might be a false positive. 

If you are running a RedHat host, make sure that the command :

  rpm -q openssh-server

returns :

  openssh-server-3.1p1-13 (RedHat 7.x)   openssh-server-3.4p1-7  (RedHat 8.0)   openssh-server-3.5p1-11 (RedHat 9)

A bug has been found in OpenSSH's buffer handling where a buffer could be marked as grown when the actual reallocation failed.

DSA-382-2: This advisory is an addition to the earlier DSA-382-1 advisory: two more buffer handling problems have been found in addition to the one described in DSA-382-1. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

DSA-382-3: This advisory is an addition to the earlier DSA-382-1 and DSA-382-2 advisories: Solar Designer found four more bugs in OpenSSH that may be exploitable.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

根据其标题，远程 SSH 服务器运行的 OpenSSH 版本低于 3.7.1。此类版本容易受到缓冲区管理函数中的缺陷的影响，可能会允许攻击者在此主机上执行任意命令。

有传言称可利用此问题。

请注意，有几次分发的版本已经修补了该漏洞，但没有改变 OpenSSH 的版本号。由于 Nessus 仅依赖于远程 SSH 服务器的标题来执行该校验，因此这可能是误报。 

如果您运行的是 RedHat 主机，则确保命令：

  rpm -q openssh-server

返回值为：

  openssh-server-3.1p1-13 (RedHat 7.x) openssh-server-3.4p1-7 (RedHat 8.0) openssh-server-3.5p1-11 (RedHat 9)

远程主机上运行的 SunSSH 版本存在信息泄露漏洞。SSH 规范中的设计缺陷可允许中间人攻击者从标准配置的受 SSH 保护的连接中恢复多达 32 位的明文。攻击者可利用这一点获取敏感信息的访问权限。

请注意，此 SunSSH 版本也易于发生多个其他问题，但 Nessus 未对其进行测试。

バナーによると、リモート SSH サーバーは、3.7.1 より古いバージョンの OpenSSL を実行しています。このようなバージョンは、バッファ管理機能の欠陥に対して脆弱であり、これによって攻撃者がこのホストで任意のコマンドを実行できることがあります。

この問題の悪用が存在すると噂されています。

いくつかのディストリビューションでは、OpenSSH のバージョン番号を変更せずに、この穴にパッチが当てられていることに、注意してください。Nessus は、このチェックを実行するために、リモート SSH サーバーのバナーにのみ依存していたため、これは誤検知の可能性があります。 

RedHat ホストを実行している場合、以下のコマンドを確認してください。

  rpm -q openssh-server

戻り：

  openssh-server-3.1p1-13（RedHat 7.x）
  openssh-server-3.4p1-7 （RedHat 8.0）
  openssh-server-3.5p1-11（RedHat 9）

リモートホストで実行されているバージョンの SunSSH に情報漏洩脆弱性があります。SSH の仕様の設計上の欠陥により、中間攻撃者が、標準構成の SSH 保護接続から最大 32 ビットまでの平文を回収できることがあります。攻撃者はこれを悪用して、機密情報にアクセスすることがあります。

このバージョンの SunSSH はいくつかのその他の問題の影響も受けやすくなっていますが、Nessus はそれらの問題をテストしていないことに、注意してください。

According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1. Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH. Since NNM solely relied on the banner of the remote SSH server to perform this check, this might be a false positive. 

If you are running a RedHat host, make sure that the command :

rpm -q openssh-server

returns :

openssh-server-3.1p1-13 (RedHat 7.x) openssh-server-3.4p1-7 (RedHat 8.0) openssh-server-3.5p1-11 (RedHat 9)

The remote host is running a version of OpenSSH that is vulnerable to a flaw in the buffer handling functions which may possibly leading to command execution.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

ID	名稱	產品	系列	已發布	已更新	嚴重性
12421	RHEL 2.1 : openssh (RHSA-2003:280)	Nessus	Red Hat Local Security Checks	2004/7/6	2021/1/14	critical
15220	Debian DSA-383-2 : ssh-krb5 - possible remote vulnerability	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
14072	Mandrake Linux Security Advisory : openssh (MDKSA-2003:090-1)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 純文字洩漏	Nessus	Misc.	2011/8/29	2020/9/21	critical
11837	OpenSSH < 3.7.1 Multiple Vulnerabilities	Nessus	Gain a shell remotely	2003/9/16	2024/3/27	critical
15219	Debian DSA-382-3 : ssh - possible remote vulnerability	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	2011/8/29	2020/9/21	critical
11837	OpenSSH < 3.7.1 多种漏洞	Nessus	Gain a shell remotely	2003/9/16	2024/3/27	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 明文泄露	Nessus	Misc.	2011/8/29	2020/9/21	critical
11837	OpenSSH < 3.7.1 の複数の脆弱性	Nessus	Gain a shell remotely	2003/9/16	2024/3/27	critical
55992	SunSSH < 1.1.1 / 1.3 CBC の平文での漏洩	Nessus	Misc.	2011/8/29	2020/9/21	critical
701168	OpenSSH < 3.7.1 Multiple Vulnerabilities	Nessus Network Monitor	SSH	2019/8/21	2019/8/21	critical
1994	OpenSSH < 3.7 buffer_append_space Function Overflow	Nessus Network Monitor	SSH	2004/8/20	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical