[openssh-unix-dev] 20040127 OpenSSH - Connection problem when LoginGraceTime exceeds time

[openssh-unix-dev] 20040128 Re: OpenSSH - Connection problem when LoginGraceTime exceeds time

RHSA-2005:550

17000

17135

17252

22875

23680

http://support.avaya.com/elmodocs2/security/ASA-2005-216.pdf

http://support.avaya.com/elmodocs2/security/ASA-2005-223.pdf

16567

FLSA-2006:168935

20061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4

20061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2

20061113 VMSA-2006-0008 - VMware ESX Server 2.0.2 Upgrade Patch 2

14963

http://www.vmware.com/download/esx/esx-202-200610-patch.html

http://www.vmware.com/download/esx/esx-213-200610-patch.html

http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html

http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html

ADV-2006-4502

openssh-sshdc-logingracetime-dos(20930)

oval:org.mitre.oval:def:11541

According to its banner, a version of OpenSSH earlier than 3.8p1 is running on the remote host and is affected by the following issues:

 - There is an issue in the handling of PAM modules in such versions of OpenSSH. As a result, OpenSSH may not correctly handle aborted conversations with PAM modules. Consequently, that memory may not be scrubbed of sensitive information such as credentials, which could lead to credentials leaking into swap space and core dumps. Other vulnerabilities in PAM modules could come to light because of unpredictable behavior.

 - Denial of service attacks are possible when privilege separation is in use. This version of OpenSSH does not properly signal non-privileged processes after session termination when 'LoginGraceTime' is exceeded. This can allow connections to remain open thereby allowing the denial of service when resources are exhausted. (CVE-2004-2069)

According to its banner, a version of OpenSSH earlier than 3.8p1 is running on the remote host and is affected by the following issues:

  - There is an issue in the handling of PAM modules in     such versions of OpenSSH.  As a result, OpenSSH may not     correctly handle aborted conversations with PAM modules.     Consequently, that memory may not be scrubbed of     sensitive information such as credentials, which could     lead to credentials leaking into swap space and core     dumps.  Other vulnerabilities in PAM modules could come     to light because of unpredictable behavior.

  - Denial of service attacks are possible when privilege     separation is in use. This version of OpenSSH does not     properly signal non-privileged processes after session     termination when 'LoginGraceTime' is exceeded. This can     allow connections to remain open thereby allowing the     denial of service when resources are exhausted.     (CVE-2004-2069)

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

Updated openssh packages that fix a potential security vulnerability and various other bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This includes the core files necessary for both the OpenSSH client and server.

A bug was found in the way the OpenSSH server handled the MaxStartups and LoginGraceTime configuration variables. A malicious user could connect to the SSH daemon in such a way that it would prevent additional logins from occuring until the malicious connections are closed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-2069 to this issue.

Additionally, the following issues are resolved with this update :

  - The -q option of the ssh client did not suppress the     banner message sent by the server, which caused errors     when used in scripts.

  - The sshd daemon failed to close the client connection if     multiple X clients were forwarded over the connection     and the client session exited.

  - The sftp client leaked memory if used for extended     periods.

  - The sshd daemon called the PAM functions incorrectly if     the user was unknown on the system.

All users of openssh should upgrade to these updated packages, which contain backported patches and resolve these issues.

ID	Name	Product	Family	Severity
701169	OpenSSH < 3.8p1 Multiple Vulnerabilities	Nessus Network Monitor	SSH	high
701169	OpenSSH < 3.8p1 Multiple Vulnerabilities	Nessus Network Monitor	SSH	high
44074	Portable OpenSSH < 3.8p1 Multiple Vulnerabilities	Nessus	Misc.	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
21839	CentOS 3 : openssh (CESA-2005:550)	Nessus	CentOS Local Security Checks	medium
19830	RHEL 3 : openssh (RHSA-2005:550)	Nessus	Red Hat Local Security Checks	medium

CVE-2004-2069

medium

Tenable Plugins

high

high

medium

critical

medium

medium