OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

  - OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-     authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads     to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE:
    the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no     supported way to enable it when building portable OpenSSH. (CVE-2019-16905)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

An update of the openssh package has been released.

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - OpenSSH 7.7 through 7.9 and 8.x before 8.1, when     compiled with an experimental key type, has a     pre-authentication integer overflow if a client or     server is configured to use a crafted XMSS key. This     leads to memory corruption and remote code execution     because of an error in the XMSS key parsing algorithm.
    NOTE: the XMSS implementation is considered     experimental in all released OpenSSH versions, and     there is no supported way to enable it when building     portable OpenSSH.(CVE-2019-16905)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - OpenSSH 7.7 through 7.9 and 8.x before 8.1, when     compiled with an experimental key type, has a     pre-authentication integer overflow if a client or     server is configured to use a crafted XMSS key. This     leads to memory corruption and local code execution     because of an error in the XMSS key parsing algorithm.
    NOTE: the XMSS implementation is considered     experimental in all released OpenSSH versions, and     there is no supported way to enable it when building     portable OpenSSH.(CVE-2019-16905)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201911-01 (OpenSSH: Integer overflow)

    OpenSSH, when built with &ldquo;xmss&rdquo; USE flag enabled, has a       pre-authentication integer overflow if a client or server is configured       to use a crafted XMSS key.
    NOTE: This USE flag is disabled by default!   Impact :

    A remote attacker could connect to a vulnerable OpenSSH server using a       special crafted XMSS key possibly resulting in execution of arbitrary       code with the privileges of the process or a Denial of Service condition.
  Workaround :

    Disable XMSS key type.

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
500847	Siemens SCALANCE X-200RNA Switch Devices Integer Overflow or Wraparound (CVE-2019-16905)	Tenable OT Security	Tenable.ot	Remote	high
133227	Photon OS 3.0: Openssh PHSA-2019-3.0-0045	Nessus	PhotonOS Local Security Checks	Local	high
132800	EulerOS Virtualization for ARM 64 3.0.5.0 : openssh (EulerOS-SA-2020-1046)	Nessus	Huawei Local Security Checks	Local	high
131360	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2019-2294)	Nessus	Huawei Local Security Checks	Local	high
130633	GLSA-201911-01 : OpenSSH: Integer overflow	Nessus	Gentoo Local Security Checks	Local	high
130455	OpenSSH 7.7 < 8.1	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2019-16905

high

Tenable Plugins

high

high

high

high

high

high