Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Transactions (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM PureData™ System for Transactions. Vulnerability Details CVE-ID:...

Security Bulletin: Vulnerability in OpenSSH affects IBM DataPower Gateways (CVE-2017-15906)

Summary A potential Denial of Service vulnerability exists in OpenSSH. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM MQ Appliance (CVE-2016-0777)

Summary An information leak flaw and buffer overflow flaw in the way the OpenSSH client roaming feature was implemented affects IBM MQ Appliance. Vulnerability Details CVEID: CVE-2016-0777 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by a client...

Security Bulletin: Vulnerabilities in Bash affect IBM Workload Deployer (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Bash is available in Red Hat Linux virtual machine images that can be deployed by using IBM Workload Deployer. Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory...

Design/Logic Flaw

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...

CVE-2011-4190

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...

CVE-2011-4190

The CVE-2011-4190 issue concerns kdump’s OpenSSH integration, where host key verification is missing in kdump and mkdumprd prior to 2012-01-20 (SUSE-specific). The root cause is lack of host key verification, enabling a remote attacker controlling a malicious kdump server to impersonate the legit...

CVE-2011-4190 Missing verification of host key for kdump server

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this fl...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2018-1140)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attacker...

EulerOS 2.0 SP2 : openssh (EulerOS-SA-2018-1141)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attacker...

Researchers Defeat AMD's SEV Virtual Machine Encryption

German security researchers claim to have found a new practical attack against virtual machines VMs protected using AMD's Secure Encrypted Virtualization SEV technology that could allow attackers to recover plaintext memory data from guest VMs. AMD's Secure Encrypted Virtualization SEV technology...

Nextcloud: Disclosed Version of PORTS SSH|HTTP|SSL

I found Version of ports are disclosed ,But the intersting that SSH port is open and showing his version == OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 Ubuntu Linux; protocol 2.0 F:302383 Searching I have found that this version has common vulunrablitie https://vuldb.com/?id.89622 So it's not good to disclos...

Amazon Linux AMI : openssh (ALAS-2018-1018)

Improper write operations in readonly mode allow for zero-length file creation The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.CVE-2017-15906 C Tenable Network Security,...

Low: openssh

Issue Overview: Improper write operations in readonly mode allow for zero-length file creation The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.CVE-2017-15906 Affected...

Scientific Linux Security Update : openssh on SL7.x x86_64 (20180410)

Security Fixes : - openssh: Improper write operations in readonly mode allow for zero- length file creation CVE-2017-15906 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109454; scriptversion"1.4";...

CentOS 7 : openssh (CESA-2018:0980)

An update for openssh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

openssh, pam_ssh_agent_auth security update

CentOS Errata and Security Advisory CESA-2018:0980 An update for openssh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Oracle Linux 7 : openssh (ELSA-2018-0980)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0980 advisory. - Fix for CVE-2017-15906 1517226 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has no...

openssh security, bug fix, and enhancement update

7.4p1-16 + 0.10.3-2 - Fix for CVE-2017-15906 1517226 7.4p1-15 + 0.10.3-2 - Do not hang if SSH AuthorizedKeysCommand output is too large 1496467 - Do not segfault pamsshagentauth if keyfile is missing 1494268 - Do not segfault in audit code during cleanup 1488083 - Add WinSCP 5.10+ compatibility...

RHEL 7 : openssh (RHSA-2018:0980)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0980 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...