sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption).

According to its banner, a version of OpenSSH earlier than 3.8p1 is running on the remote host and is affected by the following issues:

 - There is an issue in the handling of PAM modules in such versions of OpenSSH. As a result, OpenSSH may not correctly handle aborted conversations with PAM modules. Consequently, that memory may not be scrubbed of sensitive information such as credentials, which could lead to credentials leaking into swap space and core dumps. Other vulnerabilities in PAM modules could come to light because of unpredictable behavior.

 - Denial of service attacks are possible when privilege separation is in use. This version of OpenSSH does not properly signal non-privileged processes after session termination when 'LoginGraceTime' is exceeded. This can allow connections to remain open thereby allowing the denial of service when resources are exhausted. (CVE-2004-2069)

According to its banner, a version of OpenSSH earlier than 3.8p1 is running on the remote host and is affected by the following issues:

  - There is an issue in the handling of PAM modules in     such versions of OpenSSH.  As a result, OpenSSH may not     correctly handle aborted conversations with PAM modules.     Consequently, that memory may not be scrubbed of     sensitive information such as credentials, which could     lead to credentials leaking into swap space and core     dumps.  Other vulnerabilities in PAM modules could come     to light because of unpredictable behavior.

  - Denial of service attacks are possible when privilege     separation is in use. This version of OpenSSH does not     properly signal non-privileged processes after session     termination when 'LoginGraceTime' is exceeded. This can     allow connections to remain open thereby allowing the     denial of service when resources are exhausted.     (CVE-2004-2069)

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

Updated openssh packages that fix a potential security vulnerability and various other bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This includes the core files necessary for both the OpenSSH client and server.

A bug was found in the way the OpenSSH server handled the MaxStartups and LoginGraceTime configuration variables. A malicious user could connect to the SSH daemon in such a way that it would prevent additional logins from occuring until the malicious connections are closed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-2069 to this issue.

Additionally, the following issues are resolved with this update :

  - The -q option of the ssh client did not suppress the     banner message sent by the server, which caused errors     when used in scripts.

  - The sshd daemon failed to close the client connection if     multiple X clients were forwarded over the connection     and the client session exited.

  - The sftp client leaked memory if used for extended     periods.

  - The sshd daemon called the PAM functions incorrectly if     the user was unknown on the system.

All users of openssh should upgrade to these updated packages, which contain backported patches and resolve these issues.

ID	Name	Product	Family	Type	Severity
701169	OpenSSH < 3.8p1 Multiple Vulnerabilities	Nessus Network Monitor	SSH		high
44074	Portable OpenSSH < 3.8p1 Multiple Vulnerabilities	Nessus	Misc.	Remote	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	Remote	critical
21839	CentOS 3 : openssh (CESA-2005:550)	Nessus	CentOS Local Security Checks	Local	medium
19830	RHEL 3 : openssh (RHSA-2005:550)	Nessus	Red Hat Local Security Checks	Local	medium

Detections

Analytics

CVE-2004-2069

high

Tenable Plugins

high

medium

critical

medium

medium