Novell NetWare 6.5 OpenSSH Remote Stack Buffer Overflow

The version of OpenSSH running on the remote Novell NetWare host has a stack-based buffer overflow vulnerability. When attempting to resolve an absolute path on the server, data is copied into a 512 byte buffer without any bounds checking. A remote, authenticated attacker could exploit this to...

OpenSSH < 2.9.9p1 Resource Limit Bypass

According to its banner, the remote host is running a version of OpenSSH earlier than 2.9.9/2.9.9p1. Such versions fail to initiate a Pluggable Authentication Module PAM session if commands are executed with no pty. A remote, unauthenticated attacker, exploiting this flaw, could bypass resource...

OpenSSH < 3.2.3 YP Netgroups Authentication Bypass

According to its banner, the version of OpenSSH running on the remote host is older than 3.2.3. It therefore may be affected by an authentication bypass issue. On systems using YP with netgroups, sshd authenticates users via ACL by checking for the requested username and password. Under certain...

OpenSSH < 4.0 known_hosts Plaintext Host Information Disclosure

According to its banner, the remote host is running a version of OpenSSH prior to 4.0. Versions of OpenSSH earlier than 4.0 are affected by an information disclosure vulnerability because the application stores hostnames, IP addresses, and keys in plaintext in the 'knownhosts' file. A local...

OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass

According to the banner, OpenSSH earlier than 4.7 is running on the remote host. Such versions contain an authentication bypass vulnerability. In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie...

OpenSSH < 2.9.9 / 2.9p2 Symbolic Link 'cookies' File Removal

According to the banner, OpenSSH earlier than 2.9.9 / 2.9p2 is running on the remote host. Such versions contain an arbitrary file deletion vulnerability. Due to insecure handling of temporary files, a local attacker can cause sshd to delete any file it can access named 'cookies'. C Tenable, Inc...

OpenSSH < 1.2.3 xauth Session Highjacking

According to its banner, the remote host is running a version of OpenSSH earlier than 1.2.3. Such versions are affected by a session highjacking vulnerability. By default, ssh clients negotiate to forward X connections by using the xauth program to place cookies in the authorization cache of the...

OpenSSH < 5.7 Multiple Vulnerabilities

According to its banner, the version of OpenSSH running on the remote host is earlier than 5.7. Versions before 5.7 may be affected by the following vulnerabilities : - A security bypass vulnerability because OpenSSH does not properly validate the public parameters in the J-PAKE protocol. This...

OpenSSH < 4.5 Multiple Vulnerabilities

According to its banner, the remote host is running a version of OpenSSH prior to 4.5. Versions before 4.5 are affected by the following vulnerabilities : - A client-side NULL pointer dereference, caused by a protocol error from a malicious server, which could cause the client to crash...

OpenSSH < 2.5.2 / 2.5.2p2 Multiple Information Disclosure Vulnerabilities

According to its banner, the remote host appears to be running a version of OpenSSH earlier than 2.5.2 / 2.5.2p2. It, therefore, reportedly contains weaknesses in its implementation of the SSH protocol, both versions 1 and 2. These weaknesses could allow an attacker to sniff password lengths, and...

OpenSSH < 4.9 'ForceCommand' Directive Bypass

According to its banner, the version of OpenSSH installed on the remote host is earlier than 4.9. It may allow a remote, authenticated user to bypass the 'sshdconfig' 'ForceCommand' directive by modifying the '.ssh/rc' session file. C Tenable, Inc. include"compat.inc"; if description scriptid4407...

OpenSSH X11UseLocalhost X11 Forwarding Port Hijacking

According to its banner, the version of SSH installed on the remote host is older than 5.1 and may allow a local user to hijack the X11 forwarding port. The application improperly sets the 'SOREUSEADDR' socket option when the 'X11UseLocalhost' configuration option is disabled. Note that most...

OpenSSH < 4.3 scp Command Line Filename Processing Command Injection

According to its banner, the version of OpenSSH running on the remote host is potentially affected by an arbitrary command execution vulnerability. The scp utility does not properly sanitize user-supplied input prior to using a system function call. A local attacker could exploit this by creating...

Portable OpenSSH < 3.8p1 Multiple Vulnerabilities

According to its banner, a version of OpenSSH earlier than 3.8p1 is running on the remote host and is affected by the following issues: - There is an issue in the handling of PAM modules in such versions of OpenSSH. As a result, OpenSSH may not correctly handle aborted conversations with PAM...

OpenSSH < 5.2 CBC Plaintext Disclosure

The version of OpenSSH running on the remote host has an information disclosure vulnerability. A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration. An attacker could...

OpenSSH Ciphersuite Specification Information Disclosure Weakness

OpenSSH is prone to a security weakness that may allow attackers to downgrade the ciphersuite. Successfully exploiting this issue in conjunction with other latent vulnerabilities may allow attackers to gain access to sensitive information that may aid in further attacks. Releases prior to OpenSSH...

OpenSSH Ciphersuite Specification Information Disclosure Weakness

OpenSSH is prone to a security weakness that may allow attackers to downgrade the ciphersuite. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Status of OpenSSH CVEs

...

CentOS Update for openssh CESA-2009:1287 centos5 i386

Check for the Version of openssh OpenVAS Vulnerability Test CentOS Update for openssh CESA-2009:1287 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CentOS Update for openssh CESA-2009:1470 centos5 i386

Check for the Version of openssh OpenVAS Vulnerability Test CentOS Update for openssh CESA-2009:1470 centos5 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...