Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0540 advisory.

    - fixed audit log injection problem (CVE-2007-3102) (#248059)
    - fix an information leak in Kerberos password authentication (CVE-2006-5052)       (#234638)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2006:0697 :

Updated openssh packages that fix two security flaws are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

Mark Dowd discovered a signal handler race condition in the OpenSSH sshd server. A remote attacker could possibly leverage this flaw to cause a denial of service (crash). (CVE-2006-5051) The OpenSSH project believes the likelihood of successful exploitation leading to arbitrary code execution appears remote. However, the Red Hat Security Response Team have not yet been able to verify this claim due to lack of upstream vulnerability information. We are therefore including a fix for this flaw and have rated it important security severity in the event our continued investigation finds this issue to be exploitable.

Tavis Ormandy of the Google Security Team discovered a denial of service bug in the OpenSSH sshd server. A remote attacker can send a specially crafted SSH-1 request to the server causing sshd to consume a large quantity of CPU resources. (CVE-2006-4924)

All users of openssh should upgrade to these updated packages, which contain backported patches that resolves these issues.

Updated openssh packages that fix two security issues and various bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in OpenSSH server, a remote attacker may have been able to determine if a username is valid. (CVE-2006-5052)

The following bugs were also fixed :

* the ssh daemon did not generate audit messages when an ssh session was closed.

* GSSAPI authentication sometimes failed on clusters using DNS or load-balancing.

* the sftp client and server leaked small amounts of memory in some cases.

* the sftp client didn't properly exit and return non-zero status in batch mode when the destination disk drive was full.

* when restarting the ssh daemon with the initscript, the ssh daemon was sometimes not restarted successfully because the old running ssh daemon was not properly killed.

* with challenge/response authentication enabled, the pam sub-process was not terminated if the user authentication timed out.

All users of openssh should upgrade to these updated packages, which contain patches to correct these issues.

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in OpenSSH server, a remote attacker may have been able to determine if a username is valid. (CVE-2006-5052)

The following bugs were also fixed :

  - the ssh daemon did not generate audit messages when an     ssh session was closed.

  - GSSAPI authentication sometimes failed on clusters using     DNS or load-balancing.

  - the sftp client and server leaked small amounts of     memory in some cases.

  - the sftp client didn't properly exit and return non-zero     status in batch mode when the destination disk drive was     full.

  - when restarting the ssh daemon with the initscript, the     ssh daemon was sometimes not restarted successfully     because the old running ssh daemon was not properly     killed.

  - with challenge/response authentication enabled, the pam     sub-process was not terminated if the user     authentication timed out.

Problem description :

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in the OpenSSH server, a remote attacker was potentially able to determine if a username is valid. (CVE-2006-5052)

The following bugs in SELinux MLS (Multi-Level Security) support has also been fixed in this update :

  - It was sometimes not possible to select a SELinux role     and level when logging in using ssh.

  - If the user obtained a non-default SELinux role or     level, the role change was not recorded in the audit     subsystem.

  - In some cases, on labeled networks, sshd allowed logins     from level ranges it should not allow.

The updated packages also contain experimental support for using private keys stored in PKCS#11 tokens for client authentication. The support is provided through the NSS (Network Security Services) library.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

Several security problems were fixed in OpenSSH :

  - A denial of service problem has been fixed in OpenSSH     which could be used to cause lots of CPU consumption on     a remote openssh server. (CVE-2006-4924)

  - If a remote attacker is able to inject network traffic     this could be used to cause a client connection to     close. (CVE-2006-4925)

  - Fixed an unsafe signal hander reported by Mark Dowd. The     signal handler was vulnerable to a race condition that     could be exploited to perform a pre-authentication     denial of service. This vulnerability could     theoretically lead to pre-authentication remote code     execution if GSSAPI authentication is enabled, but the     likelihood of successful exploitation appears remote.
    (CVE-2006-5051)

  - Fixed a GSSAPI authentication abort that could be used     to determine the validity of usernames on some     platforms. (CVE-2006-5052)

Updated openssh packages that fix a security issue and various bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in the OpenSSH server, a remote attacker was potentially able to determine if a username is valid. (CVE-2006-5052)

The following bugs in SELinux MLS (Multi-Level Security) support has also been fixed in this update :

* It was sometimes not possible to select a SELinux role and level when logging in using ssh.

* If the user obtained a non-default SELinux role or level, the role change was not recorded in the audit subsystem.

* In some cases, on labeled networks, sshd allowed logins from level ranges it should not allow.

The updated packages also contain experimental support for using private keys stored in PKCS#11 tokens for client authentication. The support is provided through the NSS (Network Security Services) library.

All users of openssh should upgrade to these updated packages, which contain patches to correct these issues.

Several security problems were fixed in OpenSSH :

  - CVE-2006-4924: A denial of service problem has been     fixed in OpenSSH which could be used to cause lots of     CPU consumption on a remote openssh server.

  - CVE-2006-4925: If a remote attacker is able to inject     network traffic this could be used to cause a client     connection to close.

  - CVE-2006-5051: Fixed an unsafe signal hander reported by     Mark Dowd. The signal handler was vulnerable to a race     condition that could be exploited to perform a     pre-authentication denial of service. This vulnerability     could theoretically lead to pre-authentication remote     code execution if GSSAPI authentication is enabled, but     the likelihood of successful exploitation appears     remote.

  - CVE-2006-5052: Fixed a GSSAPI authentication abort that     could be used to determine the validity of usernames on     some platforms.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.9 or a version of Mac OS X 10.3 which does not have Security Update 2007-003 applied.

This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is affected by the vulnerability described in GLSA-200611-06 (OpenSSH: Multiple Denial of Service vulnerabilities)

    Tavis Ormandy of the Google Security Team has discovered a     pre-authentication vulnerability, causing sshd to spin until the login     grace time has been expired. Mark Dowd found an unsafe signal handler     that was vulnerable to a race condition. It has also been discovered     that when GSSAPI authentication is enabled, GSSAPI will in certain     cases incorrectly abort.
  Impact :

    The pre-authentication and signal handler vulnerabilities can cause a     Denial of Service in OpenSSH. The vulnerability in the GSSAPI     authentication abort could be used to determine the validity of     usernames on some platforms.
  Workaround :

    There is no known workaround at this time.

Updated openssh packages that fix two security flaws are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

Mark Dowd discovered a signal handler race condition in the OpenSSH sshd server. A remote attacker could possibly leverage this flaw to cause a denial of service (crash). (CVE-2006-5051) The OpenSSH project believes the likelihood of successful exploitation leading to arbitrary code execution appears remote. However, the Red Hat Security Response Team have not yet been able to verify this claim due to lack of upstream vulnerability information. We are therefore including a fix for this flaw and have rated it important security severity in the event our continued investigation finds this issue to be exploitable.

Tavis Ormandy of the Google Security Team discovered a denial of service bug in the OpenSSH sshd server. A remote attacker can send a specially crafted SSH-1 request to the server causing sshd to consume a large quantity of CPU resources. (CVE-2006-4924)

All users of openssh should upgrade to these updated packages, which contain backported patches that resolves these issues.

New openssh packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

The remote host is running a version of OpenSSH that is vulnerable to a flaw in the way that it handles GSSAPI authentication.  If the SSH server is configured to utilize GSSAPI authentication then the host may be compromised by a remote attacker with access to the SSH port (typically 22).  Successful exploitation would result in remote code execution.

The version of OpenSSH running on the remote host is prior to version 4.4. Such versions are affected by multiple vulnerabilities:

 - A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that successful exploitation requires that GSSAPI authentication be enabled.
 - A flaw exists that may allow an attacker to determine the validity of usernames on some platforms. Note that this issue requires that GSSAPI authentication be enabled.
 - When SSH version 1 is used, an issue can be triggered via an SSH packet that contains duplicate blocks that could result in a loss of availability for the service.
 - On Fedora Core 6 (and possibly other systems), an unspecified vulnerability in the linux_audit_record_event() function allows remote attackers to inject incorrect information into audit logs.

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities :

  - A race condition exists that may allow an     unauthenticated, remote attacker to crash the service     or, on portable OpenSSH, possibly execute code on the     affected host.  Note that successful exploitation     requires that GSSAPI authentication be enabled.
    
  - A flaw exists that may allow an attacker to determine     the validity of usernames on some platforms. Note that     this issue requires that GSSAPI authentication be     enabled.

  - When SSH version 1 is used, an issue can be triggered     via an SSH packet that contains duplicate blocks that     could result in a loss of availability for the service.

  - On Fedora Core 6 (and possibly other systems), an     unspecified vulnerability in the     linux_audit_record_event() function allows remote     attackers to inject incorrect information into     audit logs.

ID	Name	Product	Family	Severity
180606	Oracle Linux 5 : openssh (ELSA-2007-0540)	Nessus	Oracle Linux Local Security Checks	critical
67412	Oracle Linux 4 : openssh (ELSA-2006-0697)	Nessus	Oracle Linux Local Security Checks	high
67053	CentOS 4 : openssh (CESA-2007:0703)	Nessus	CentOS Local Security Checks	medium
60306	Scientific Linux Security Update : openssh on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60296	Scientific Linux Security Update : openssh on SL5.x	Nessus	Scientific Linux Local Security Checks	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
29538	SuSE 10 Security Update : OpenSSH (ZYPP Patch Number 2184)	Nessus	SuSE Local Security Checks	high
28237	RHEL 4 : openssh (RHSA-2007:0703)	Nessus	Red Hat Local Security Checks	medium
27829	RHEL 5 : openssh (RHSA-2007:0540)	Nessus	Red Hat Local Security Checks	medium
27365	openSUSE 10 Security Update : openssh (openssh-2183)	Nessus	SuSE Local Security Checks	high
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
24811	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus	MacOS X Local Security Checks	critical
23671	GLSA-200611-06 : OpenSSH: Multiple Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	high
22485	CentOS 3 / 4 : openssh / openssl (CESA-2006:0697)	Nessus	CentOS Local Security Checks	high
22473	RHEL 3 / 4 : openssh (RHSA-2006:0697)	Nessus	Red Hat Local Security Checks	high
22468	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : openssh (SSA:2006-272-02)	Nessus	Slackware Local Security Checks	high
3754	OpenBSD Portable OpenSSH < 4.4.p1 GSSAPI Authentication Overflow	Nessus Network Monitor	SSH	high
3751	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus Network Monitor	SSH	low
22466	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2006-5052

critical

Tenable Plugins

critical

high

medium

medium

medium

critical

high

medium

medium

high

high

critical

high

high

high

high

high

low

high