650 matches found
CVE-2015-6563
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITORREQPAMINITCTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafte...
DEBIAN-CVE-2015-5600
The kbdintnextdevice function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service CPU consumptio...
CVE-2015-5600
Summary (CVE-2015-5600): The kbdint_next_device function in OpenSSH sshd up to version 6.9 fails to properly constrain keyboard-interactive device processing within a single connection, enabling remote brute-force attempts or a denial-of-service via a long/duplicative ssh -oKbdInteractiveDevices ...
ipa security and bug fix update
3.0.0-47.el6 - Resolves: 1220788 - Some IPA schema files are not RFC 4512 compliant 3.0.0-46.el6 - Use tls version range in NSSHTTPS initialization - Resolves: 1154687 - POODLE: force using safe ciphers non-SSLv3 in IPA client and server - Resolves: 1012224 - host certificate not issued to client...
Mandriva Linux Security Advisory : openssh (MDVSA-2015:095)
Updated openssh packages fix security vulnerabilities : sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshdconfig, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character CVE-2014-2532...
openssh security, bug fix and enhancement update
6.6.1p1-11 + 0.9.3-9 - fix direction in CRYPTOSESSION audit message 1171248 6.6.1p1-10 + 0.9.3-9 - add new option GSSAPIEnablek5users and disable using /.k5users by default CVE-2014-9278 1169843 6.6.1p1-9 + 0.9.3-9 - log via monitor in chroots without /dev/log 1083482 6.6.1p1-8 + 0.9.3-9 - increa...
Moderate: Red Hat Security Advisory: openssh security, bug fix and enhancement update
Updated openssh packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...
[SECURITY] Fedora 20 Update: denyhosts-2.6-29.fc20.1
DenyHosts is a Python script that analyzes the sshd server log messages to determine which hosts are attempting to hack into your system. It also determines what user accounts are being targeted. It keeps track of the frequency of attempts from each host and, upon discovering a repeated attack...
[SECURITY] Fedora 19 Update: denyhosts-2.6-28.fc19.1
DenyHosts is a Python script that analyzes the sshd server log messages to determine which hosts are attempting to hack into your system. It also determines what user accounts are being targeted. It keeps track of the frequency of attempts from each host and, upon discovering a repeated attack...
CVE-2014-8475
The CVE-2014-8475 issue affects FreeBSD 9.1, 9.2, and 10.0 when OpenSSH is built with Kerberos support. The root cause is incorrect library ordering during linking sshd, causing SES symbols to be resolved incorrectly and allowing a remote attacker to cause a denial of service by ending multiple c...
CVE-2014-8475
FreeBSD 9.1, 9.2, and 10.0, when compiling OpenSSH with Kerberos support, uses incorrect library ordering when linking sshd, which causes symbols to be resolved incorrectly and allows remote attackers to cause a denial of service sshd deadlock and prevention of new connections by ending multiple...
Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20141014)
It was discovered that OpenSSH clients did not correctly verify DNS SSHFP records. A malicious server could use this flaw to force a connecting client to skip the DNS SSHFP record check and require the user to perform manual host verification of the DNS SSHFP record. CVE-2014-2653 It was found th...
[slackware-security] openssh
New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssh-6.7p1-i486-1slack14.1.txz: Upgraded. This update fixes a security issue that allows remote servers...
CVE-2014-6278
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and...
Design/Logic Flaw
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service uninitialized memory access, and untrusted-pointer read and write operations via a crafted...
Important: bash
Issue Overview: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vecto...
Mikrotik RouterOS sshd (ROSSSH) - Remote Preauth Heap Corruption
No description provided by source...
Fedora 20 : openssh-6.4p1-4.fc20 (2014-6380)
environment variables with embedded '=' or '\0' characters are now ignored - prevents a server from skipping SSHFP lookup and forcing a new-hostkey dialog by offering only certificate keys - ssh-agent is now suspend-aware as it gets also CLOCKBOOTTIME time - /etc/ssh/moduli is readable by all now...
Mandriva Linux Security Advisory : openssh (MDVSA-2014:068)
Updated openssh packages fixes security vulnerabilities : sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshdconfig, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character...
