USN-2014-1: OpenSSH vulnerability

Markus Friedl discovered that OpenSSH incorrectly handled memory when the AES-GCM cipher was used. A remote authenticated attacker could use this issue to execute arbitrary code as their user, possibly bypassing shell or command restrictions...

Security fix for the ALT Linux 8 package openssh version 5.9p1-alt7

Nov. 8, 2013 Dmitry V. Levin 5.9p1-alt7 - sshd: applied upstream initialization fix CVE-2013-4548...

Security fix for the ALT Linux 6 package openssh version 5.9p1-alt7

Nov. 8, 2013 Dmitry V. Levin 5.9p1-alt7 - sshd: applied upstream initialization fix CVE-2013-4548...

CVE-2013-4548

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

Internet Bug Bounty: OpenSSH: Memory corruption in AES-GCM support

Vulnerability A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the privileges of the...

OpenSSH -- Memory corruption in sshd

The OpenSSH development team reports: A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the...

OpenSSH maxstartup Threshold Connection Exhaustion Denial of Service - ver 2 (CVE-2010-5107)

A denial of service vulnerability exists in the OpenSSH server daemon sshd. The vulnerability is due to a default configuration that only allows a small number of unauthenticated connections, after which the server will stop accepting any new connections. A remote unauthenticated attacker can...

OpenSSH maxstartup Threshold Connection Exhaustion denial of service (CVE-2010-5107)

A denial of service vulnerability exists in the OpenSSH server daemon sshd. The vulnerability is due to a default configuration that only allows a small number of unauthenticated connections, after which the server will stop accepting any new connections. A remote unauthenticated attacker can...

SOL14741 - OpenSSH vulnerability CVE-2010-5107

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL14742 - OpenSSH vulnerability CVE-2008-4109

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

SOL14740 - OpenSSH vulnerability CVE-2011-5000

Recommended action F5 recommends that you only allow SSH access to the administrative port from a secure network. Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of...

SOL14739 - OpenSSH vulnerability CVE-2008-3234

Recommended Action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

Amazon Linux AMI : openssh (ALAS-2013-165)

Due to the way the pamsshagentauth PAM module was built, the glibc's error function was called rather than the intended error function in pamsshagentauth to report errors. As these two functions expect different arguments, it was possible for an attacker to cause an application using...

Amazon Linux AMI : openssh (ALAS-2012-99)

A denial of service flaw was found in the OpenSSH GSSAPI authentication implementation. A remote, authenticated user could use this flaw to make the OpenSSH server daemon sshd use an excessive amount of memory, leading to a denial of service. GSSAPI authentication is enabled by default...

SuSE 11.2 Security Update : OpenSSH (SAT Patch Number 8078)

This update for OpenSSH provides the following fixes : - Implement remote denial of service hardening. bnc802639, CVE-2010-5107 - Use only FIPS 140-2 approved algorithms when FIPS mode is detected. bnc755505, bnc821039 - Do not link OpenSSH binaries with LDAP libraries. bnc826906 %NASLMINLEVEL...

SOL14609 - OpenSSH vulnerability CVE-2008-5161

Vulnerability Recommended Actions To eliminate this vulnerability, upgrade to a version that is listed in the Versions known to be not vulnerable column in the previous table. Note: BIG-IP and Enterprise Manager systems running fixed versions can be affected when an older OpenSSH client connects ...

OpenSSH远程拒绝服务漏洞

Bugtraq ID:61286 OpenSSH是一种开放源码的SSH协议的实现 OpenSSH存在一个安全漏洞，允许远程攻击者利用漏洞提交恶意请求，使应用程序崩溃，造成拒绝服务攻击 0 OpenSSH 厂商解决方案 目前没有详细解决方案提供： http://www.openssh.com/...

Oracle Linux 5 : openssh (ELSA-2009-1470)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1470 advisory. 4.3p2-36.2 - minimize chroot patch to be compatible with upstream 522141 Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 4 : openssh (ELSA-2007-0257)

From Red Hat Security Advisory 2007:0257 : Updated openssh packages that fix a security issue and various bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This...

Oracle Linux 3 / 4 : openssh (ELSA-2006-0738)

From Red Hat Security Advisory 2006:0738 : Updated openssh packages that fix an authentication flaw are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protoco...