The SSH key generation process in OpenSSH in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote attackers to cause a denial of service by connecting to the server before SSH has finished creating keys, which causes the keys to be regenerated and can break trust relationships that were based on the original keys.

The installed version of OpenSSH is prior to 4.5 and is affected by the following vulnerabilities:

 - A client-side NULL pointer dereference, caused by a protocol error from a malicious server, which could cause the client to crash. (CVE-2006-4925)
 - A privilege separation vulnerability exists, which could allow attackers to bypass authentication. The vulnerability is caused by a design error between privileged processes and their child processes. Note that this particular issue is only exploitable when other vulnerabilities are present. (CVE-2006-5794)
 - An attacker that connects to the service before it has finished creating keys could force the keys to be recreated. This could result in a denial of service for any processes that relies on a trust relationship with the server. Note that this particular issue only affects the Apple implementation of OpenSSH on Mac OS X. (CVE-2007-0726)

According to its banner, the remote host is running a version of OpenSSH prior to 4.5.  Versions before 4.5 are affected by the following vulnerabilities :

  - A client-side NULL pointer dereference, caused by a     protocol error from a malicious server, which could     cause the client to crash. (CVE-2006-4925)

  - A privilege separation vulnerability exists, which could     allow attackers to bypass authentication. The     vulnerability is caused by a design error between     privileged processes and their child processes. Note     that this particular issue is only exploitable when     other vulnerabilities are present. (CVE-2006-5794)

  - An attacker that connects to the service before it has     finished creating keys could force the keys to be     recreated. This could result in a denial of service for     any processes that relies on a trust relationship with     the server. Note that this particular issue only affects     the Apple implementation of OpenSSH on Mac OS X.     (CVE-2007-0726)

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.9 or a version of Mac OS X 10.3 which does not have Security Update 2007-003 applied.

This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

ID	Name	Product	Family	Severity
701165	OpenSSH < 4.5 Multiple Vulnerabilities	Nessus Network Monitor	SSH	high
44077	OpenSSH < 4.5 Multiple Vulnerabilities	Nessus	Misc.	high
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
24811	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2007-0726

high

Tenable Plugins

high

high

high

critical