OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is running a version of OpenSSH between 2.5.x and 2.9.x. Depending on the order of the user keys in ~/.ssh/authorized_keys2, sshd might fail to apply the source IP based access control restriction to the correct key. This problem allows users to circumvent the system policy and login from disallowed source IP address.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner. 

In some circumstances, the sshd server may not honor the 'from=' option that can be associated with a key in a user's ~/.ssh/authorized_keys2 file if multiple keys are listed. This could allow key-based logins from hosts which should not be allowed access.

According to its banner, the remote host appears to be running OpenSSH version between 2.5.x and 2.9.  Such versions reportedly contain multiple vulnerabilities :

  - sftp-server does not respect the 'command=' argument of     keys in the authorized_keys2 file. (CVE-2001-0816)

  - sshd does not properly handle the 'from=' argument of     keys in the authorized_keys2 file. If a key of one type     (e.g. RSA) is followed by a key of another type (e.g.     DSA) then the options for the latter will be applied to     the former, including 'from=' restrictions. This problem     allows users to circumvent the system policy and login     from disallowed source IP addresses. (CVE-2001-1380)

ID	Name	Product	Family	Type	Severity
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	Remote	critical
1988	OpenSSH < 2.9.9 Multiple Key Type ACL Bypass	Nessus Network Monitor	SSH		medium
13894	Mandrake Linux Security Advisory : openssh (MDKSA-2001:081)	Nessus	Mandriva Local Security Checks	Local	high
10771	OpenSSH 2.5.x - 2.9 Multiple Vulnerabilities	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2001-1380

high

Tenable Plugins

critical

medium

high

high