OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for
    authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not
    resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-
    location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we
    do not consider it to be the application's responsibility to defend against platform architectural
    weaknesses." (CVE-2023-51767)

OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for     authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not     resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-     location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states we     do not consider it to be the application's responsibility to defend against platform architectural     weaknesses. (CVE-2023-51767)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
436892	Alpine: multiple openssh packages: security update to 9.7_p1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
436892	Alpine: multiple openssh packages: security update to 9.7_p1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
503821	Siemens SIMATIC Devices Improper Input Validation (CVE-2023-51767)	Tenable OT Security	Tenable.ot	Remote	high
227195	Linux Distros Unpatched Vulnerability : CVE-2023-51767	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2023-51767

high

Tenable Plugins

high

high

high

high