OpenSSH < 10.6 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364698);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/14");

  script_cve_id("CVE-2026-106583");
  script_xref(name:"IAVA", value:"2026-A-1103");

  script_name(english:"OpenSSH < 10.6 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The SSH server running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of OpenSSH installed on the remote host is prior to 10.6. It is, therefore, affected by multiple
vulnerabilities as referenced in the release-10.6 advisory.

  - In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to
    injection. (CVE-2026-106583)

  - sftp(1) did not strictly validate paths returned from the server, allowing some cases where a malicious
    server could return paths that manipulate a recursive copy operation into writing outside its target
    directory. (no CVE assigned)

  - ssh(1) and sshd(8) shared a single LZ77 compression dictionary across multiplexed channels, allowing a
    chosen-plaintext side-channel attack to recover secrets from one channel by interacting with the shared
    compression context through another channel. (no CVE assigned)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.openssh.com/txt/release-10.6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to OpenSSH version 10.6 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-106583");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/12");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:openbsd:openssh");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("openssh_detect.nbin");
  script_require_keys("installed_sw/OpenSSH");
  script_require_ports("Services/ssh", 22);

  exit(0);
}

include('backport.inc');
include('vcf.inc');
include('vcf_extras.inc');

var port = get_service(svc:'ssh', default:22, exit_on_fail:TRUE);
var app_info = vcf::openssh::get_app_info(app:'OpenSSH', port:port);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'fixed_version': '10.6'}
];

vcf::openssh::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);