Detections
Analytics
AIX OpenSSH Advisory : openssh_advisory7.asc
medium Nessus Plugin ID 88590
Language:
Synopsis
The remote AIX host has a version of OpenSSH installed that is affected by multiple vulnerabilities.Description
The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :- An information disclosure vulnerability exists in the resend_bytes() function in the undocumented roaming connection feature. An authenticated, remote attacker can exploit this vulnerability, by persuading a victim to connect to a malicious server, to retrieve private cryptographic keys or other sensitive information.
(CVE-2016-0777)
- A heap-based buffer overflow condition exists in the undocumented roaming connection feature due to improper bounds checking of user-supplied input to the packet_write_wait() and ssh_packet_write_wait() functions whenever the non-default option ProxyCommand is used with either ForwardAgent or ForwardX11. An authenticated, remote attacker can exploit this vulnerability, by persuading a victim to connect to a malicious server, to execute arbitrary code or cause a denial of service. (CVE-2016-0778)
Solution
A fix is available and can be downloaded from the IBM AIX website.See Also
https://aix.software.ibm.com/aix/efixes/security/openssh_advisory7.asc
Plugin Details
Severity: Medium
ID: 88590
File Name: aix_openssh_advisory7.nasl
Version: 1.10
Type: local
Family: AIX Local Security Checks
Published: 2/5/2016
Updated: 4/21/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:ibm:aix, cpe:/a:openbsd:openssh
Required KB Items: Host/local_checks_enabled, Host/AIX/version, Host/AIX/lslpp
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/29/2016
Vulnerability Publication Date: 1/14/2016
Reference Information
CVE: CVE-2016-0777, CVE-2016-0778
CERT: 456088