The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.

The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window. (CVE-2015-5352)

Impact

A remote attacker may be able to bypass intended access restrictions.

Security Fix(es) :

  - It was found that the OpenSSH client did not properly     enforce the ForwardX11Timeout setting. A malicious or     compromised remote X application could possibly use this     flaw to establish a trusted connection to the local X     server, even if only untrusted X11 forwarding was     requested. (CVE-2015-5352)

  - A flaw was found in the way OpenSSH handled PAM     authentication when using privilege separation. An     attacker with valid credentials on the system and able     to fully compromise a non-privileged pre-authentication     process using a different flaw could use this flaw to     authenticate as other users. (CVE-2015-6563)

  - A use-after-free flaw was found in OpenSSH. An attacker     able to fully compromise a non-privileged     pre-authentication process using a different flaw could     possibly cause sshd to crash or execute arbitrary code     with root privileges. (CVE-2015-6564)

  - An access flaw was discovered in OpenSSH; the OpenSSH     client did not correctly handle failures to generate     authentication cookies for untrusted X11 forwarding. A     malicious or compromised remote X application could     possibly use this flaw to establish a trusted connection     to the local X server, even if only untrusted X11     forwarding was requested. (CVE-2016-1908)

An update for openssh is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2015-5352)

* A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. (CVE-2015-6563)

* A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. (CVE-2015-6564)

* An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

From Red Hat Security Advisory 2016:0741 :

An update for openssh is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2015-5352)

* A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. (CVE-2015-6563)

* A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. (CVE-2015-6564)

* An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0741 advisory.

  - openssh: XSECURITY restrictions bypass under certain conditions in ssh(1) (CVE-2015-5352)

  - openssh: Privilege separation weakness related to PAM support (CVE-2015-6563)

  - openssh: Use-after-free bug related to PAM support (CVE-2015-6564)

  - openssh: possible fallback from untrusted to trusted X11 forwarding (CVE-2016-1908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of OpenSSH server before 6.9 are affected by the following vulnerabilities : 

 - A flaw within the 'x11_open_helper()' function in the 'channels.c' file that allows connections to be permitted after 'ForwardX11Timeout' has expired. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions. (CVE-2015-5352) 
 - Various issues were addressed by fixing the weakness in agent locking by increasing the failure delay, storing the salted hash of the password, and using a timing-safe comparison function. 
 - An out-of-bounds read error exists when handling incorrect pattern lengths. A remote attacker can exploit this to cause a denial of service or disclose sensitive information in the memory. 
 - An out-of-bounds read error exists when parsing the 'EscapeChar' configuration option.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

The remote host is affected by the vulnerability described in GLSA-201512-04 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

  Workaround :

    There is no known workaround at this time.

openssh was updated to fix four security issues.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function in     channels.c in ssh in OpenSSH when ForwardX11Trusted mode     is not used, lacked a check of the refusal deadline for     X connections, which made it easier for remote attackers     to bypass intended access restrictions via a connection     outside of the permitted time window (bsc#936695).

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd in OpenSSH did not properly     restrict the processing of keyboard-interactive devices     within a single connection, which made it easier for     remote attackers to conduct brute-force attacks or cause     a denial of service (CPU consumption) via a long and     duplicative list in the ssh -oKbdInteractiveDevices     option, as demonstrated by a modified client that     provides a different password for each pam element on     this list (bsc#938746).

  - CVE-2015-4000: Removed and disabled weak DH groups     (bsc#932483).

  - Hardening patch to fix sftp RCE (bsc#903649).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OpenSSH was updated to fix several security issues and bugs.

Please note that due to a bug in the previous shipped openssh version, sshd might not correctly restart. Please verify that the ssh daemon is running after installing this update.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function, when     ForwardX11Trusted mode is not used, lacked a check of     the refusal deadline for X connections, which made it     easier for remote attackers to bypass intended access     restrictions via a connection outside of the permitted     time window. (bsc#936695)

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd did not properly restrict the     processing of keyboard-interactive devices within a     single connection, which made it easier for remote     attackers to conduct brute-force attacks or cause a     denial of service (CPU consumption) via a long and     duplicative list in the ssh

    -oKbdInteractiveDevices option, as demonstrated by a     modified client that provides a different password for     each pam element on this list. (bsc#938746)

  - CVE-2015-4000: Removed and disabled weak DH groups to     address LOGJAM. (bsc#932483)

  - Hardening patch to fix sftp RCE. (bsc#903649)

  - CVE-2015-6563: The monitor component in sshd accepted     extraneous username data in MONITOR_REQ_PAM_INIT_CTX     requests, which allowed local users to conduct     impersonation attacks by leveraging any SSH login access     in conjunction with control of the sshd uid to send a     crafted MONITOR_REQ_PWNAM request, related to monitor.c     and monitor_wrap.c.

  - CVE-2015-6564: Use-after-free vulnerability in the     mm_answer_pam_free_ctx function in monitor.c in sshd     might have allowed local users to gain privileges by     leveraging control of the sshd uid to send an     unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

Additional a bug was fixed that could lead to openssh not working in chroot (bsc#947458).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

openssh was updated to fix several security issues and bugs.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function in     channels.c in ssh in OpenSSH when ForwardX11Trusted mode     is not used, lacked a check of the refusal deadline for     X connections, which made it easier for remote attackers     to bypass intended access restrictions via a connection     outside of the permitted time window (bsc#936695).

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd in OpenSSH did not properly     restrict the processing of keyboard-interactive devices     within a single connection, which made it easier for     remote attackers to conduct brute-force attacks or cause     a denial of service (CPU consumption) via a long and     duplicative list in the ssh -oKbdInteractiveDevices     option, as demonstrated by a modified client that     provides a different password for each pam element on     this list (bsc#938746).

  - CVE-2015-4000: Removed and disabled weak DH groups to     address LOGJAM (bsc#932483).

  - Hardening patch to fix sftp RCE (bsc#903649).

  - CVE-2015-6563: The monitor component in sshd in OpenSSH     accepted extraneous username data in     MONITOR_REQ_PAM_INIT_CTX requests, which allowed local     users to conduct impersonation attacks by leveraging any     SSH login access in conjunction with control of the sshd     uid to send a crafted MONITOR_REQ_PWNAM request, related     to monitor.c and monitor_wrap.c.

  - CVE-2015-6564: Use-after-free vulnerability in the     mm_answer_pam_free_ctx function in monitor.c in sshd in     OpenSSH might have allowed local users to gain     privileges by leveraging control of the sshd uid to send     an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenSSH running on the remote host is affected by a security bypass vulnerability due to a failure to check the refusal deadline during the forwarding of untrusted X11 connections. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions.

openssh was updated to fix several security issues.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function in     channels.c in ssh in OpenSSH when ForwardX11Trusted mode     is not used, lacked a check of the refusal deadline for     X connections, which made it easier for remote attackers     to bypass intended access restrictions via a connection     outside of the permitted time window (bsc#936695).

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd in OpenSSH did not properly     restrict the processing of keyboard-interactive devices     within a single connection, which made it easier for     remote attackers to conduct brute-force attacks or cause     a denial of service (CPU consumption) via a long and     duplicative list in the ssh -oKbdInteractiveDevices     option, as demonstrated by a modified client that     provides a different password for each pam element on     this list (bsc#938746).

  - CVE-2015-4000: Removed and disabled weak DH groups to     address LOGJAM (bsc#932483).

  - Hardening patch to fix sftp RCE (bsc#903649).

  - CVE-2015-6563: The monitor component in sshd in OpenSSH     accepted extraneous username data in     MONITOR_REQ_PAM_INIT_CTX requests, which allowed local     users to conduct impersonation attacks by leveraging any     SSH login access in conjunction with control of the sshd     uid to send a crafted MONITOR_REQ_PWNAM request, related     to monitor.c and monitor_wrap.c. (bsc#943010)

  - CVE-2015-6564: Use-after-free vulnerability in the     mm_answer_pam_free_ctx function in monitor.c in sshd in     OpenSSH might have allowed local users to gain     privileges by leveraging control of the sshd uid to send     an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
    (bsc#943006)

Also use %restart_on_update in the trigger script.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix for CVE-2015-5600 caused a regression resulting in random authentication failures in non-default configurations. This update fixes the problem.

Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to perform user impersonation. (CVE number pending)

Moritz Jodeit discovered that OpenSSH incorrectly handled context memory when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to bypass authentication or possibly execute arbitrary code. (CVE number pending)

Jann Horn discovered that OpenSSH incorrectly handled time windows for X connections. A remote attacker could use this issue to bypass certain access restrictions. (CVE-2015-5352)

It was discovered that OpenSSH incorrectly handled keyboard-interactive authentication. In a non-default configuration, a remote attacker could possibly use this issue to perform a brute-force password attack.
(CVE-2015-5600).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Moritz Jodeit discovered that OpenSSH incorrectly handled usernames when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to perform user impersonation. (CVE number pending)

Moritz Jodeit discovered that OpenSSH incorrectly handled context memory when using PAM authentication. If an additional vulnerability were discovered in the OpenSSH unprivileged child process, this issue could allow a remote attacker to bypass authentication or possibly execute arbitrary code. (CVE number pending)

Jann Horn discovered that OpenSSH incorrectly handled time windows for X connections. A remote attacker could use this issue to bypass certain access restrictions. (CVE-2015-5352)

It was discovered that OpenSSH incorrectly handled keyboard-interactive authentication. In a non-default configuration, a remote attacker could possibly use this issue to perform a brute-force password attack. (CVE-2015-5600).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was reported that when forwarding X11 connections with ForwardX11Trusted=no, connections made after ForwardX11Timeout expired could be permitted and no longer subject to XSECURITY restrictions because of an ineffective timeout check in ssh(1) coupled with 'fail open' behavior in the X11 server when clients attempted connections with expired credentials.

This update brings security fix for two announced vulnerabilities.
Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking (ssh-add -x) to password guessing (more info in related bugs). For more information see related bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings security fix for two announced vulnerabilities.
Namely XSECURITY restrictions bypass under certain conditions AND weakness of agent locking (ssh-add -x) to password guessing (more info in related bugs). It also provides new version of openssh-6.9 which is bringing many bugfixes and few new features with maintaining compatibility with previous version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of OpenSSH running on the remote host is prior to 6.9. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists within the x11_open_helper() function in     the 'channels.c' file that allows connections to be     permitted after 'ForwardX11Timeout' has expired. A     remote attacker can exploit this to bypass timeout     checks and XSECURITY restrictions. (CVE-2015-5352)

  - Various issues were addressed by fixing the weakness in     agent locking by increasing the failure delay, storing     the salted hash of the password, and using a timing-safe     comparison function.

  - An out-of-bounds read error exists when handling     incorrect pattern lengths. A remote attacker can exploit     this to cause a denial of service or disclose sensitive     information in the memory.

  - An out-of-bounds read error exists when parsing the     'EscapeChar' configuration option.

ID	Name	Product	Family	Severity
97560	F5 Networks BIG-IP : OpenSSH vulnerability (K17461)	Nessus	F5 Networks Local Security Checks	medium
91540	Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20160510)	Nessus	Scientific Linux Local Security Checks	critical
91166	CentOS 6 : openssh (CESA-2016:0741)	Nessus	CentOS Local Security Checks	critical
91148	Oracle Linux 6 : openssh (ELSA-2016-0741)	Nessus	Oracle Linux Local Security Checks	critical
91073	RHEL 6 : openssh (RHSA-2016:0741)	Nessus	Red Hat Local Security Checks	critical
9308	OpenSSH < 6.9 Multiple Vulnerabilities	Nessus Network Monitor	SSH	high
87545	GLSA-201512-04 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
86695	SUSE SLES11 Security Update : openssh (SUSE-SU-2015:1840-1) (Logjam)	Nessus	SuSE Local Security Checks	low
86339	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2015:1695-1) (Logjam)	Nessus	SuSE Local Security Checks	low
86057	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2015:1581-1) (Logjam)	Nessus	SuSE Local Security Checks	low
85941	SUSE SLED11 Security Update : openssh (SUSE-SU-2015:1547-2) (Logjam)	Nessus	SuSE Local Security Checks	low
85930	AIX OpenSSH Vulnerability : openssh_advisory5.asc	Nessus	AIX Local Security Checks	medium
85929	SUSE SLES11 Security Update : openssh (SUSE-SU-2015:1547-1) (Logjam)	Nessus	SuSE Local Security Checks	low
85928	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2015:1544-1) (Logjam)	Nessus	SuSE Local Security Checks	low
85533	Ubuntu 14.04 LTS : OpenSSH regression (USN-2710-2)	Nessus	Ubuntu Local Security Checks	high
85445	Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2710-1)	Nessus	Ubuntu Local Security Checks	high
84928	Amazon Linux AMI : openssh (ALAS-2015-568)	Nessus	Amazon Linux Local Security Checks	medium
84688	Fedora 21 : openssh-6.6.1p1-13.fc21 (2015-11067)	Nessus	Fedora Local Security Checks	medium
84687	Fedora 22 : openssh-6.9p1-1.fc22 (2015-11063)	Nessus	Fedora Local Security Checks	medium
84638	OpenSSH < 6.9 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2015-5352

critical

Tenable Plugins

medium

critical

critical

critical

critical

high

high

low

low

low

low

medium

low

low

high

high

medium

medium

medium

high