Moderate: Red Hat Security Advisory: openssh security and bug fix update

Updated openssh packages that fix a security issue and various bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. These packages include the core files necessar...

audit logging of failed logins

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

GLSA-200711-02 : OpenSSH: Security bypass

The remote host is affected by the vulnerability described in GLSA-200711-02 OpenSSH: Security bypass Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it cannot create an untrusted one. Impact : An attacker could bypass the SSH client security policy and gain privileges by...

OpenSSH: Security bypass

Background OpenSSH is a complete SSH protocol implementation that includes an SFTP client and server support. Description Jan Pechanec discovered that OpenSSH uses a trusted X11 cookie when it cannot create an untrusted one. Impact An attacker could bypass the SSH client security policy and gain...

CVE-2007-5715

DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as...

Code injection

DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as...

CVE-2007-5715

DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as...

CVE-2007-5715

DenyHosts 2.6 is vulnerable due to an incorrect regular expression used to parse failed SSH login attempts, which may allow remote attackers to evade detection/block when attempting logins with a username not present in AllowUsers (the issue demonstrated using the root username). Affected impleme...

CVE-2007-5715

DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as...

openSUSE 10 Security Update : openssh (openssh-4579)

This update fixes a bug in ssh's cookie handling code. It does not properly handle the situation when an untrusted cookie cannot be created and uses a trusted X11 cookie instead. This allows attackers to violate the intended policy and gain privileges by causing an X client to be treated as...

CVE-2007-3102

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

CVE-2007-3102

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

Design/Logic Flaw

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

CVE-2007-3102

OpenSSH 4.3p2 contains an unspecified vulnerability in linux_audit_record_event that allows remote attackers to write arbitrary characters to the audit log via a crafted username. Reported on Fedora Core 6 and possibly other systems (CVE-2007-3102). Public advisories note a fix was released (e.g....

CVE-2007-3102

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

CVE-2007-3102

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

OpenSSH LINUX_AUDIT_RECORD_EVENT远程记录注入漏洞

OpenSSH是一款开放源码的SSH协议的实现。 OpenSSH存在设计问题，远程攻击者可以利用漏洞注入非法数据到日志条目中，导致攻击被隐藏。 目前没有详细漏洞细节提供。 RedHat Fedora Core6 OpenSSH OpenSSH 4.3p2 Fedora发布了安全公告并修补了此漏洞： http://www.openssh.org/...

openSUSE 10 Security Update : openssh (openssh-2183)

Several security problems were fixed in OpenSSH : - CVE-2006-4924: A denial of service problem has been fixed in OpenSSH which could be used to cause lots of CPU consumption on a remote openssh server. - CVE-2006-4925: If a remote attacker is able to inject network traffic this could be used to...

openSUSE 10 Security Update : openssh (openssh-2256)

The OpenSSH release 4.5 contains a security fix which has been backported to the openssh versions in our old products. CVE-2006-5794: Incorrect return argument checking in the privilege separation monitor was fixed. In case of an exploitable unprivileged helper this could have been used to elevat...

Fedora Core 6 : openssh-4.3p2-25.fc6 (2007-715)

Tue Oct 2 2007 Tomas Mraz - 4.3p2-25 - do not fall back on trusted X11 cookies CVE-2007-4752 280471 - Fri Jul 13 2007 Tomas Mraz - 4.3p2-24 - fixed audit log injection problem CVE-2007-3102 248059 - Thu Jun 21 2007 Tomas Mraz - 4.3p2-23 - document where the nss certificate and token dbs are...