OpenSSH < 6.9 Multiple Vulnerabilities

High Nessus Plugin ID 84638

Synopsis

The SSH server running on the remote host is affected by multiple vulnerabilities.

Description

According to its banner, the version of OpenSSH running on the remote host is prior to 6.9. It is, therefore, affected by the following vulnerabilities :

- A flaw exists within the x11_open_helper() function in the 'channels.c' file that allows connections to be permitted after 'ForwardX11Timeout' has expired. A remote attacker can exploit this to bypass timeout checks and XSECURITY restrictions. (CVE-2015-5352)

- Various issues were addressed by fixing the weakness in agent locking by increasing the failure delay, storing the salted hash of the password, and using a timing-safe comparison function.

- An out-of-bounds read error exists when handling incorrect pattern lengths. A remote attacker can exploit this to cause a denial of service or disclose sensitive information in the memory.

- An out-of-bounds read error exists when parsing the 'EscapeChar' configuration option.

Solution

Upgrade to OpenSSH 6.9 or later.

See Also

http://www.openssh.com/txt/release-6.9

http://www.nessus.org/u?725c4682

Plugin Details

Severity: High

ID: 84638

File Name: openssh_69.nasl

Version: 1.7

Type: remote

Family: Misc.

Published: 2015/07/09

Updated: 2018/09/17

Dependencies: 10267

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

CVSS Score Source: manual

CVSS Score Rationale: Score from a more in depth analysis done by tenable

CVSS v2.0

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Required KB Items: Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2015/06/30

Vulnerability Publication Date: 2015/07/01

Reference Information

CVE: CVE-2015-5352

BID: 75525