6535 matches found
Mandrake Linux Security Advisory : openssh (MDKSA-2001:081)
In some circumstances, the sshd server may not honor the 'from=' option that can be associated with a key in a user's /.ssh/authorizedkeys2 file if multiple keys are listed. This could allow key-based logins from hosts which should not be allowed access. %NASLMINLEVEL 70300 C Tenable Network...
Mandrake Linux Security Advisory : openssh (MDKSA-2003:090-1)
A buffer management error was discovered in all versions of openssh prior to version 3.7. According to the OpenSSH team's advisory: 'It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs fixed proactively.' There have also been reports of an exploit in the...
Mandrake Linux Security Advisory : openssh (MDKSA-2001:092)
The new OpenSSH 3.0.2 fixes a vulnerability in the UseLogin option. By default, Mandrake Linux does not enable UseLogin, but if the administrator enables it, local users are able to pass environment variables to the login process. This update also fixes a security hole in the KerberosV support th...
Mandrake Linux Security Advisory : openssh (MDKSA-2002:040-1)
An input validation error exists in the OpenSSH server between versions 2.3.1 and 3.3 that can result in an integer overflow and privilege escalation. This error is found in the PAMAuthenticationViaKbdInt code in versions 2.3.1 to 3.3, and the ChallengeResponseAuthentication code in versions 2.9....
SUSE-SA:2003:043: openssl
The remote host is missing the patch for the advisory SUSE-SA:2003:043 openssl. OpenSSL is an implementation of the Secure Socket Layer SSL v2/3 and Transport Layer Security TLS v1 protocol. While checking the openssl implementation with a tool-kit from NISCC several errors were revealed most are...
SUSE-SA:2003:039: openssh (second release)
The remote host is missing the patch for the advisory SUSE-SA:2003:039 openssh second release. The openssh package is the most widely used implementation of the secure shell protocol family ssh. It provides a set of network connectivity tools for remote shell login, designed to substitute the...
SUSE-SA:2003:038: openssh
The remote host is missing the patch for the advisory SUSE-SA:2003:038 openssh. The openssh package is the most widely used implementation of the secure shell protocol family ssh. It provides a set of network connectivity tools for remote shell login, designed to substitute the traditional...
RHEL 2.1 : openssh (RHSA-2002:131)
Updated openssh packages are now available for Red Hat Linux Advanced Server. These updates fix an input validation error in OpenSSH. OpenSSH provides an implementation of the SSH secure shell protocol used for logging into and executing commands on remote machines. Versions of the OpenSSH server...
RHEL 2.1 : openssh (RHSA-2003:280)
Updated OpenSSH packages are now available that fix bugs that may be remotely exploitable. Updated 17 Sep 2003 Updated packages are now available to fix additional buffer manipulation problems which were fixed in OpenSSH 3.7.1. The Common Vulnerabilities and Exposures project cve.mitre.org has...
RHEL 2.1 : openssh (RHSA-2003:224)
Updated OpenSSH packages are now available. These updates close an information leak caused by sshd's interaction with the PAM system. OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login...
SOL3066 - OpenSSH buffer management vulnerability - CA-2003-24
For information about this vulnerability, refer to...
CVE-2004-0175
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992...
CVE-2004-0175
CVE-2004-0175 is a directory traversal via scp in OpenSSH prior to 3.4p1, enabling a remote server to overwrite arbitrary files on the client. Root cause is improper path handling in scp. Affected product: OpenSSH (scp component). Impact: allows remote file overwrites. Mitigation: upgrade to Open...
CVE-2004-0175
Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992...
PT-2004-1077 · Openssh +3 · Openssh +4
Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 3.4p1 rsh-server-0.17 rsh-0.17 Description: The issue is related to a directory traversal vulnerability in the scp component of OpenSSH, which can be exploited by remote malicious servers to overwrite arbitrary files...
CVE-2003-1562
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password...
CVE-2003-1562
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password...
Race Condition
Overview Affected versions of this package are vulnerable to Race Condition sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier...
PT-2003-2507 · Openssh +1 · Openssh +1
Name of the Vulnerable Software and Affected Versions: OpenSSH versions 3.6.1p2 and earlier Description: The issue allows remote attackers to potentially determine if the password step of a multi-step authentication is successful by using timing differences. This occurs when PermitRootLogin is...