Ubuntu 13.10 : openssh vulnerability (USN-2014-1)

Markus Friedl discovered that OpenSSH incorrectly handled memory when the AES-GCM cipher was used. A remote authenticated attacker could use this issue to execute arbitrary code as their user, possibly bypassing shell or command restrictions. Note that Tenable Network Security has extracted the...

CVE-2013-4548

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

CVE-2013-4548

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

Design/Logic Flaw

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

CVE-2013-4548

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

CVE-2013-4548

CVE-2013-4548 affects OpenSSH sshd 6.2/6.3 when using AES-GCM. The bug is in mm_newkeys_from_blob (monitor_wrap.c) where memory for a MAC context isn’t initialized, allowing remote authenticated users to bypass ForceCommand and login-shell restrictions via crafted packet data. Several connected s...

CVE-2013-4548

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

USN-2014-1: OpenSSH vulnerability

Markus Friedl discovered that OpenSSH incorrectly handled memory when the AES-GCM cipher was used. A remote authenticated attacker could use this issue to execute arbitrary code as their user, possibly bypassing shell or command restrictions...

Security fix for the ALT Linux 6 package openssh version 5.9p1-alt7

Nov. 8, 2013 Dmitry V. Levin 5.9p1-alt7 - sshd: applied upstream initialization fix CVE-2013-4548...

CVE-2013-4548

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

Security fix for the ALT Linux 8 package openssh version 5.9p1-alt7

Nov. 8, 2013 Dmitry V. Levin 5.9p1-alt7 - sshd: applied upstream initialization fix CVE-2013-4548...

OpenSSH -- Memory corruption in sshd

The OpenSSH development team reports: A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the...

Internet Bug Bounty: OpenSSH: Memory corruption in AES-GCM support

Vulnerability A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the privileges of the...

OpenSSH maxstartup Threshold Connection Exhaustion Denial of Service - ver 2 (CVE-2010-5107)

A denial of service vulnerability exists in the OpenSSH server daemon sshd. The vulnerability is due to a default configuration that only allows a small number of unauthenticated connections, after which the server will stop accepting any new connections. A remote unauthenticated attacker can...

OpenSSH maxstartup Threshold Connection Exhaustion denial of service (CVE-2010-5107)

A denial of service vulnerability exists in the OpenSSH server daemon sshd. The vulnerability is due to a default configuration that only allows a small number of unauthenticated connections, after which the server will stop accepting any new connections. A remote unauthenticated attacker can...

SOL14741 - OpenSSH vulnerability CVE-2010-5107

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL14740 - OpenSSH vulnerability CVE-2011-5000

Recommended action F5 recommends that you only allow SSH access to the administrative port from a secure network. Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of...

SOL14739 - OpenSSH vulnerability CVE-2008-3234

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

SOL14742 - OpenSSH vulnerability CVE-2008-4109

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

Amazon Linux AMI : openssh (ALAS-2012-99)

A denial of service flaw was found in the OpenSSH GSSAPI authentication implementation. A remote, authenticated user could use this flaw to make the OpenSSH server daemon sshd use an excessive amount of memory, leading to a denial of service. GSSAPI authentication is enabled by default...