RHEL 4 / 5 : openssh (RHSA-2008:0855)
high Nessus Plugin ID 34034
Language:
Synopsis
The remote Red Hat host is missing one or more security updates.Description
Updated openssh packages are now available for Red Hat Enterprise Linux 4, Red Hat Enterprise Linux 5, and Red Hat Enterprise Linux 4.5 Extended Update Support.This update has been rated as having critical security impact by the Red Hat Security Response Team.
OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation.
Last week Red Hat detected an intrusion on certain of its computer systems and took immediate action. While the investigation into the intrusion is on-going, our initial focus was to review and test the distribution channel we use with our customers, Red Hat Network (RHN) and its associated security measures. Based on these efforts, we remain highly confident that our systems and processes prevented the intrusion from compromising RHN or the content distributed via RHN and accordingly believe that customers who keep their systems updated using Red Hat Network are not at risk. We are issuing this alert primarily for those who may obtain Red Hat binary packages via channels other than those of official Red Hat subscribers.
In connection with the incident, the intruder was able to sign a small number of OpenSSH packages relating only to Red Hat Enterprise Linux 4 (i386 and x86_64 architectures only) and Red Hat Enterprise Linux 5 (x86_64 architecture only). As a precautionary measure, we are releasing an updated version of these packages, and have published a list of the tampered packages and how to detect them at http://www.redhat.com/security/data/openssh-blacklist.html
To reiterate, our processes and efforts to date indicate that packages obtained by Red Hat Enterprise Linux subscribers via Red Hat Network are not at risk.
These packages also fix a low severity flaw in the way ssh handles X11 cookies when creating X11 forwarding connections. When ssh was unable to create untrusted cookie, ssh used a trusted cookie instead, possibly allowing the administrative user of a untrusted remote server, or untrusted application run on the remote server, to gain unintended access to a users local X server. (CVE-2007-4752)
Solution
Update the affected packages.See Also
https://access.redhat.com/security/cve/cve-2007-4752
https://access.redhat.com/security/cve/cve-2008-3844
Plugin Details
Severity: High
ID: 34034
File Name: redhat-RHSA-2008-0855.nasl
Version: 1.40
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 8/24/2008
Updated: 1/26/2022
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:openssh, p-cpe:/a:redhat:enterprise_linux:openssh-askpass, p-cpe:/a:redhat:enterprise_linux:openssh-askpass-gnome, p-cpe:/a:redhat:enterprise_linux:openssh-clients, p-cpe:/a:redhat:enterprise_linux:openssh-server, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:4.5, cpe:/o:redhat:enterprise_linux:4.7, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:5.2
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 8/22/2008
Vulnerability Publication Date: 9/11/2007
Reference Information
CVE: CVE-2007-4752, CVE-2008-3844