SLAD Fetch Results

This script connects to SLAD on a remote host to fetch the result from scripts started earlier. To work properly, this script requires to be provided with a valid SSH login by means of an SSH key with pass- phrase if the SSH public key is passphrase-protected, or a password to log in. OpenVAS...

Code injection

The SSH key generation process in OpenSSH in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote attackers to cause a denial of service by connecting to the server before SSH has finished creating keys, which causes the keys to be regenerated and can break trust relationships that were...

CVE-2007-0726

CVE-2007-0726 affects Apple Mac OS X OpenSSH: SSH key generation on OS X 10.3.9 and 10.4 (up to 10.4.8) can be exploited by remote attackers who connect before key generation completes, causing keys to be regenerated and potentially breaking trust relationships based on the original keys. The des...

pam_ssh空密码短语绕过认证限制漏洞

pamssh是结合SSH密钥和SSH客户端使用的PAM模块，允许使用SSH密钥为UNIX提供登录服务。 pamssh的实现上存在漏洞，远程攻击者可能利用此漏洞获取非授权访问。 如果禁用了allowblankpassphrase选项的话，pamssh的pamssh.c文件中的authviakey函数会无法正确地限制同空密码短语使用私钥。在提示输入密码短语时用户可以输入随机的非空短语绕过认证限制而使用空密码短语私钥。 pamssh 1.91 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

[security bulletin] HPSBMA02173 SSRT061230 rev. 1 - HP Integrated Lights Out (iLO & iLO 2) Running SSH Key Based Authentication Remote Unauthorized Access

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00800677 Version: 1 HPSBMA02173 SSRT061230 rev. 1 - HP Integrated Lights Out iLO & iLO 2 Running SSH Key Based Authentication Remote Unauthorized Access NOTICE: The information in this Security...

CVE-2005-2770

WRQ Reflection for Secure IT Windows Server 6.0 formerly known as F-Secure SSH server does not properly handle when the Windows Administrator or Guest accounts are renamed after SSH key authentication has been configured, which allows remote attackers to use the original names during login...

CVE-2005-2770

WRQ Reflection for Secure IT Windows Server 6.0 formerly known as F-Secure SSH server does not properly handle when the Windows Administrator or Guest accounts are renamed after SSH key authentication has been configured, which allows remote attackers to use the original names during login...

MRV InReach console server restrictions protection bypass

If SSH key is used for authentication ports restrictions are not applied...

4.3 Security: local DoS via clean-tmps

Tested in 4.3-RELEASE only: If /etc/periodic/daily/clean-tmps is enabled, then it's possible for any local user to trick it into calling unlink or rmdir on anything in the root directory. The problem is that "find -delete" can be made to do chdir".." multiple times followed by unlink and/or rmdir...