Lynis 2.7.0 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

SUSE SLES11 Security Update : openssh (SUSE-SU-2018:3540-1)

This update for openssh fixes the following issues : Security issues fixed : CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such ...

SUSE-SU-2018:3540-1 Security update for openssh

This update for openssh fixes the following issues: Security issues fixed: - CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such ...

Exploit for Race Condition in Openbsd Openssh

CVE-2018-15473 OpenSSH 7.7 - Username Enumeration Method T...

Security Bulletin: Vulnerability in OpenSSH affects AIX (CVE-2018-15473)

Summary Vulnerability in OpenSSH affects AIX. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. By sending a specially crafted request, an...

Vulnerabilities in OpenSSH affect AIX.

IBM SECURITY ADVISORY First Issued: Wed Oct 24 11:28:50 CDT 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/opensshadvisory12.asc https://aix.software.ibm.com/aix/efixes/security/opensshadvisory12.asc...

SUSE SLES12 Security Update : openssh (SUSE-SU-2018:2530-2)

This update for openssh fixes the following issues : Security issue fixed : CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message bsc1076957. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

SUSE-SU-2018:2530-2 Security update for openssh

This update for openssh fixes the following issues: Security issue fixed: - CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message bsc1076957...

libssh Authentication Bypass Makes it Trivial to Pwn Rafts of Servers

The libssh open-source project has issued an update to address an authentication bypass vulnerability in the server code — to say that it’s trivial to exploit is an understatement. The flaw CVE-2018-10933 exists in libssh versions 0.6 and above being used in server mode – and it allows anyone to...

PT-2018-2486

Name of the Vulnerable Software and Affected Versions OpenSSH version 7.9 Description The issue is caused by errors in checking the directory name in the scp.c file in the scp client. This allows a remote attacker to modify the access permissions of the target directory by using a filename of "."...

GLSA-201810-03 : OpenSSH: User enumeration vulnerability

The remote host is affected by the vulnerability described in GLSA-201810-03 OpenSSH: User enumeration vulnerability It was discovered that OpenSSH was prone to a user enumeration vulnerability. Impact : A remote attacker could conduct user enumeration. Workaround : There is no known workaround a...

OpenSSH: User enumeration vulnerability

Background OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support. Description It was discovered that OpenSSH was prone to a user enumeration vulnerability. Impact A remote attacker could conduct user enumeration. Workaround There is no known workaround at...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in OpenSSH. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote...

BSA-2018-540

Security Advisory ID : BSA-2018-540 Component : OpenSSH Revision : 2.0: Final The 1 roamingread and 2 roamingwrite functions in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file...

BSA-2018-539

Security Advisory ID : BSA-2018-539 Component : OpenSSH Revision : 2.0: Final The resendbytes function in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffe...

Amazon Linux 2 : openssh (ALAS-2018-1075)

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.CVE-2018-15473 C Tenable Network...

Security Bulletin: OpenSSH vulnerability affects IBM Spectrum Protect Plus (CVE-2017-15906)

Summary OpenSSH is vulnerable to a denial of service vulnerability which affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote...

Low: openssh

Issue Overview: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.CVE-2018-15473 Affecte...

EulerOS Virtualization 2.5.0 : openssh (EulerOS-SA-2018-1254)

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an...

SUSE-SU-2018:2719-1 Security update for openssh-openssl1

This update for openssh-openssl1 fixes the following issues: These security issues were fixed: - CVE-2016-10708: Prevent NULL pointer dereference via an out-of-sequence NEWKEYS message allowed remote attackers to cause a denial of service bsc1076957. - CVE-2017-15906: The processopen function did...