Mandriva Linux Security Advisory : openssh (MDVSA-2008:098)

Medium Nessus Plugin ID 36276


The remote Mandriva Linux host is missing one or more security updates.


A vulnerability in OpenSSH 4.4 through 4.8 allowed local attackers to bypass intended security restrictions enabling them to execute commands other than those specified by the ForceCommand directive, provided they are able to modify to ~/.ssh/rc (CVE-2008-1657).

The updated packages have been patched to correct this issue.


Update the affected packages.

Plugin Details

Severity: Medium

ID: 36276

File Name: mandriva_MDVSA-2008-098.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2009/04/23

Modified: 2015/03/19

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:openssh, p-cpe:/a:mandriva:linux:openssh-askpass, p-cpe:/a:mandriva:linux:openssh-askpass-common, p-cpe:/a:mandriva:linux:openssh-askpass-gnome, p-cpe:/a:mandriva:linux:openssh-clients, p-cpe:/a:mandriva:linux:openssh-server, cpe:/o:mandriva:linux:2007.1, cpe:/o:mandriva:linux:2008.0, cpe:/o:mandriva:linux:2008.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2008/05/06

Reference Information

CVE: CVE-2008-1657

BID: 28531

MDVSA: 2008:098

CWE: 264