K000140975: OpenSSH vulnerability CVE-2024-6409

Security Advisory Description A race condition vulnerability was discovered in how signals are handled by OpenSSH's server sshd. If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in OpenSSH

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of OpenSSH Vulnerability Details CVEID:CVE-2024-6387 DESCRIPTION: OpenSSH could allow a remote attacker to execute arbitrary code on the system, caused by a signal handler race condition. By sending a specially...

IT threat evolution Q2 2024

Targeted attacks XZ backdoor: a supply chain attack in the making On March 29, a message on the Openwall oss-security mailing list announced the discovery of a backdoor in XZ, a compression utility included in many popular Linux distributions. The backdoored library is used by the OpenSSH server...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2024-2333)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.12.1 : openssh (EulerOS-SA-2024-2313)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2024-2313)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rocky Linux 9 : OpenSSH regreSSHion (CVE-2024-6387)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the 'Rocky Linux 9 - CVE-2024-6387: regreSSHion' news article. sshd: Signal handler race condition that can lead to a potential remote code execution. CVE-2024-6387 Note this plugin only...

EulerOS Virtualization 2.12.0 : openssh (EulerOS-SA-2024-2333)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without...

SSH Username Enumeration

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH Username Enumeration', 'Description' = %q This module uses a malformed packet or timing attack to enumerate users on an OpenSSH server. The...

Exploit for Race Condition in Openbsd Openssh

RegreSSHion CVE-2024-6387: Critical Remote Code Execution Vuln...

Security Bulletin: OpenSSH for IBM i is vulnerable to an attacker executing arbitrary code due to a signal handler race condition. [CVE-2024-6387]

Summary OpenSSH used by IBM i is vulnerable to a remote attacker executing arbitrary code due to a signal handler race condition as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes section...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387 Vulnerability Checker Overview This Python...

Exploit for Race Condition in Openbsd Openssh

PoC exploit for CVE-2024-6387, a remote code execution vulnerabi...

CVE-2024-39894 affecting package openssh for versions less than 9.8p1-1

CVE-2024-39894 affecting package openssh for versions less than 9.8p1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-6387 affecting package openssh for versions less than 9.8p1-1

CVE-2024-6387 affecting package openssh for versions less than 9.8p1-1. An upgraded version of the package is available that resolves this issue...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2024-2286)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K000140768: OpenSSH vulnerability CVE-2024-7589

Security Advisory Description A signal handler in sshd8 may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds 120 by default. This signal handler executes in the context of the sshd8's...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to OpenSSH arbitrary code execution vulnerability [CVE-2024-6387]

Summary Potential OpenSSH arbitrary code execution vulnerability CVE-2024-6387 have been identified that could affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-6387...

EulerOS Virtualization 2.11.0 : openssh (EulerOS-SA-2024-2184)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A signal handler race condition was found in OpenSSH's server sshd, where a client does not authenticate within LoginGraceTime...

Huawei EulerOS: Security Advisory for openssh (EulerOS-SA-2024-2222)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...