OpenSSH < 4.4 Multiple Vulnerabilities

High Nessus Plugin ID 22466

Synopsis

The remote SSH server is affected by multiple vulnerabilities.

Description

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities :

- A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that successful exploitation requires that GSSAPI authentication be enabled.

- A flaw exists that may allow an attacker to determine the validity of usernames on some platforms. Note that this issue requires that GSSAPI authentication be enabled.

- When SSH version 1 is used, an issue can be triggered via an SSH packet that contains duplicate blocks that could result in a loss of availability for the service.

- On Fedora Core 6 (and possibly other systems), an unspecified vulnerability in the linux_audit_record_event() function allows remote attackers to inject incorrect information into audit logs.

Solution

Upgrade to OpenSSH 4.4 or later.

See Also

http://www.openssh.com/txt/release-4.4

Plugin Details

Severity: High

ID: 22466

File Name: openssh_44.nasl

Version: 1.30

Type: remote

Family: Misc.

Published: 2006/09/28

Updated: 2018/07/16

Dependencies: 10267

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Temporal Score: 7.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2006/09/28

Reference Information

CVE: CVE-2006-4924, CVE-2006-4925, CVE-2006-5051, CVE-2006-5052, CVE-2006-5229, CVE-2007-3102, CVE-2008-4109

BID: 20216, 20241, 20245

CWE: 264, 362, 399