OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.

The version of OpenSSH running on the remote host is affected by the following vulnerabilities :

  - X11 man-in-the-middle attack:
    When attempting to bind(2) to a port that has previously     been bound with SO_REUSEADDR set, most operating systems     check that either the effective user-id matches the     previous bind (common on BSD-derived systems) or that     the bind addresses do not overlap. When the     sshd_config(5) option X11UseLocalhost has been set to     'no' - an attacker may establish a more-specific bind,     which will be used in preference to sshd's wildcard     listener. (CVE-2008-3259)

  - Plaintext Recovery Attack Against SSH:
    If exploited, this attack can potentially allow an     attacker to recover up to 32 bits of plaintext from an     arbitrary block of ciphertext from a connection secured     using the SSH protocol in the standard configuration.
    If OpenSSH is used in the standard configuration, then     the attacker's success probability for recovering 32     bits of plaintext is 2^{-18}. A variant of the attack     against OpenSSH in the standard configuration can     verifiably recover 14 bits of plaintext with probability     2^{-14}. The success probability of the attack for other     implementations of SSH is not known. (CVE-2008-5161)

According to its banner, the version of SSH installed on the remote host is older than 5.1 and may allow a local user to hijack the X11 forwarding port.  The application improperly sets the 'SO_REUSEADDR' socket option when the 'X11UseLocalhost' configuration option is disabled.

Note that most operating systems, when attempting to bind to a port that has previously been bound with the 'SO_REUSEADDR' option, will check that either the effective user-id matches the previous bind (common BSD-derived systems) or that the bind addresses do not overlap (Linux and Solaris).  This is not the case with other operating systems such as HP-UX.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

According to its banner, the version of SSH installed on the remote host is older than 5.1.  Such versions may allow a local user to hijack X11 sessions because it improperly checks user privileges before re-binding a port.  In order for the attack to be successful, the 'X11UseLocalhost' option would need to be disabled.  By default, the option is enabled.  Further, the OpenSSH service would need to be running on an operating system (such as HP-UX) where the effective user ID is not checked.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

ID	Name	Product	Family	Severity
73557	AIX OpenSSH Advisory: openssh_advisory.asc	Nessus	AIX Local Security Checks	low
44080	OpenSSH X11UseLocalhost X11 Forwarding Port Hijacking	Nessus	Misc.	low
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
4598	OpenSSH X11 < 5.1 Session Hijacking	Nessus Network Monitor	SSH	medium

Detections

Analytics

CVE-2008-3259

high

Tenable Plugins

low

low

critical

medium