sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.

sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username
    data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by
    leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted
    MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. (CVE-2015-6563)

  - Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before
    7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd
    uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. (CVE-2015-6564)

  - sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to
    cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a
    device, as demonstrated by writing an escape sequence. (CVE-2015-6565)

According to its self-reported version number, the remote pfSense install is prior to 2.2.5. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.

Versions of OpenSSH server before 7.0 are affected by multiple vulnerabilities: 

 - A flaw in the 'kbdint_next_device()' function in 'file auth2-chall.c' that allows the circumvention of MaxAuthTries during keyboard-interactive authentication. An attacker can exploit this issue to force the same authentication method to be tried thousands of times in a single pass by using a crafted keyboard-interactive 'devices' string, thus allowing a brute-force attack or causing a denial of service. (CVE-2015-5600) 
 - A flaw in sshd(8) is due to the program setting insecure world-writable permissions for TTYs allowing a local attacker to execute arbitrary commands for logged-in users by injecting crafted terminal escape sequences. (CVE-2015-6565) 
 - A flaw in the monitor component is triggered when handling username data in MONITOR_REQ_PAM_INIT_CTX requests allowing a local user to leverage the SSH login access and control of the sshd(8) UID to send a MONITOR_REQ_PWNAM request to conduct an impersonation attack. (CVE-2015-6563) 
 - A use-after-free error in the 'mm_answer_pam_free_ctx()' function of monitor.c is triggered when handling a MONITOR_REQ_PAM_FREE_CTX request allowing a local attacker to take control of the sshd UID to send a request leading to a dereference of already freed memory and gain elevated privileges. (CVE-2015-6564)

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

The remote host is affected by the vulnerability described in GLSA-201512-04 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

  Workaround :

    There is no known workaround at this time.

OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable. Local attackers may be able to write arbitrary messages to logged-in users, including terminal escape sequences. Reported by Nikolay Edigaryev.

Fixed a privilege separation weakness related to PAM support.
Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users.

Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution.

According to its banner, the version of OpenSSH running on the remote host is prior to 7.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in the     kbdint_next_device() function in file auth2-chall.c that     allows the circumvention of MaxAuthTries during     keyboard-interactive authentication. A remote attacker     can exploit this issue to force the same authentication     method to be tried thousands of times in a single pass     by using a crafted keyboard-interactive 'devices'     string, thus allowing a brute-force attack or causing a     denial of service. (CVE-2015-5600)

  - A security bypass vulnerability exists in sshd due to     improper handling of username data in     MONITOR_REQ_PAM_INIT_CTX requests. A local attacker can     exploit this, by sending a MONITOR_REQ_PWNAM request, to     conduct an impersonation attack. Note that this issue     only affects Portable OpenSSH. (CVE-2015-6563)

  - A privilege escalation vulnerability exists due to a     use-after-free error in sshd that is triggered when     handling a MONITOR_REQ_PAM_FREE_CTX request. A local     attacker can exploit this to gain elevated privileges.
    Note that this issue only affects Portable OpenSSH.
    (CVE-2015-6564)

  - A local command execution vulnerability exists in sshd     due to setting insecure world-writable permissions for     TTYs. A local attacker can exploit this, by injecting     crafted terminal escape sequences, to execute commands     for logged-in users. (CVE-2015-6565)

ID	Name	Product	Family	Type	Severity
503055	Siemens SCALANCE X-200RNA Switch Devices Improper Access Control (CVE-2015-6565)	Tenable OT Security	Tenable.ot	Remote	high
401103	Alpine: multiple openssh packages: security update to 6.9-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
401103	Alpine: multiple openssh packages: security update to 6.9-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
106497	pfSense < 2.2.5 Multiple Vulnerabilities (SA-15_08)	Nessus	Firewalls	Remote	critical
9309	OpenSSH < 7.0 Multiple Vulnerabilities	Nessus Network Monitor	SSH		high
87545	GLSA-201512-04 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
85594	FreeBSD : OpenSSH -- PAM vulnerabilities (2920c449-4850-11e5-825f-c80aa9043978)	Nessus	FreeBSD Local Security Checks	Local	high
85382	OpenSSH < 7.0 Multiple Vulnerabilities	Nessus	Misc.	Remote	medium

Detections

Analytics

CVE-2015-6565

high

Tenable Plugins

high

high

high

critical

high

high

high

medium