AIX OpenSSH Advisory : openssh_advisory7.asc

Medium Nessus Plugin ID 88590

Synopsis

The remote AIX host has a version of OpenSSH installed that is affected by multiple vulnerabilities.

Description

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities :

- An information disclosure vulnerability exists in the resend_bytes() function in the undocumented roaming connection feature. An authenticated, remote attacker can exploit this vulnerability, by persuading a victim to connect to a malicious server, to retrieve private cryptographic keys or other sensitive information.
(CVE-2016-0777)

- A heap-based buffer overflow condition exists in the undocumented roaming connection feature due to improper bounds checking of user-supplied input to the packet_write_wait() and ssh_packet_write_wait() functions whenever the non-default option ProxyCommand is used with either ForwardAgent or ForwardX11. An authenticated, remote attacker can exploit this vulnerability, by persuading a victim to connect to a malicious server, to execute arbitrary code or cause a denial of service. (CVE-2016-0778)

Solution

A fix is available and can be downloaded from the IBM AIX website.

See Also

http://aix.software.ibm.com/aix/efixes/security/openssh_advisory7.asc

Plugin Details

Severity: Medium

ID: 88590

File Name: aix_openssh_advisory7.nasl

Version: 1.8

Type: local

Published: 2016/02/05

Modified: 2018/07/17

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:ibm:aix, cpe:/a:openbsd:openssh

Required KB Items: Host/AIX/lslpp, Host/local_checks_enabled, Host/AIX/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2016/01/29

Vulnerability Publication Date: 2016/01/14

Reference Information

CVE: CVE-2016-0777, CVE-2016-0778

BID: 80695, 80698

CERT: 456088

EDB-ID: 39247