OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.

The remote host is affected by the vulnerability described in GLSA-201405-06 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, cause a Denial of       Service condition, obtain sensitive information, or bypass environment       restrictions.
  Workaround :

    There is no known workaround at this time.

Versions of OpenSSH server before 5.7 may be affected by the following vulnerabilities :

  - A security bypass vulnerability because OpenSSH does not properly validate the public parameters in the J-PAKE protocol.  This could allow an attacker to authenticate without the shared secret.  Note that this issue is only exploitable when OpenSSH is built with J-PAKE support, which is currently experimental and disabled by default. (CVE-2010-4478)

  - The auth_parse options function in auth-options.c in sshd provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages. (CVE-2012-0841)

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

According to its banner, the version of OpenSSH running on the remote host is earlier than 5.7.  Versions before 5.7 may be affected by the following vulnerabilities :

  - A security bypass vulnerability because OpenSSH does not     properly validate the public parameters in the J-PAKE     protocol.  This could allow an attacker to authenticate     without the shared secret.  Note that this issue is only     exploitable when OpenSSH is built with J-PAKE support,     which is currently experimental and disabled by default,     and that Nessus has not checked whether J-PAKE support     is indeed enabled. (CVE-2010-4478)

  - The auth_parse_options function in auth-options.c in     sshd provides debug messages containing authorized_keys     command options, which allows remote, authenticated     users to obtain potentially sensitive information by     reading these messages. (CVE-2012-0814)

ID	Name	Product	Family	Type	Severity
73958	GLSA-201405-06 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
6300	OpenSSH < 5.7 Multiple Vulnerabilities	Nessus Network Monitor	SSH		medium
44081	OpenSSH < 5.7 Multiple Vulnerabilities	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2010-4478

critical

Tenable Plugins

medium

medium

high