The remote host is running OpenSSH SSH client older than 2.3.0. This version does not properly disable X11 or agent forwarding, which could allow a rogue SSH server to gain access to the X11 display of the client and eavesdrop X11 events.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner. 

The remote host is running a version of SSH which is older than (or as old as) 1.2.23. This version is vulnerable to a known plaintext attack that may allow an attacker to insert encrypted packets in the client - server stream that will be deciphered by the server, thus allowing an attacker to execute arbitrary commands on the remote server.

The remote host is running a version of SSH which is older (or as old as) version 1.2.27. If it was compiled with Kerberos support, an attacker may exploit a bug in the Kerberos implementation and may eavesdrop the ticket cache of the users.

The remote host is running SSH Communication Security's SSH 1.2.27 to 1.2.30. With Secure-RPC, this version may allow local attackers to recover a SUN-DES-1 magic phrase generated by another user that the attacker can use to decrypt the private key file of the user. 

The remote SSH server (or client) is vulnerable to various vulnerabilities that may allow an attacker to obtain a root shell on this host.

The remote SSH server is vulnerable to various vulnerabilities that may allow an attacker to obtain a root shell on this host.

The remote host is running a version of SSH which is older (or as old as) 1.2.27. If this version was compiled against the RSAREF library (which can not be determined remotely), then it is very likely to be vulnerable to a buffer overflow that may allow an attacker to obtain a root shell on this host. To determine if SSH has been compiled against the RSAREF library, log into the remote host and type 'ssh -V' 

The remote host is using version 1.5 of the SSH protocol. This version allows a remote attacker to decrypt and/or alter traffic via an attack against PKCS#1 version 1.5, called the 'Bleichenbacher' attack. OpenSSH up to version 2.3.0, AppGate and SSH Communications Security ssh1 update to version 1.2.31 are vulnerable to this attack. 

The remote host is running SSH 1.2.3 or 1.2 (as a client). There is a vulnerability in this version that allows a malicious scp server to overwrite arbitrary files via a directory traversal bug. An attacker may use this flaw to compromise this host. To exploit it, the attacker would have to compromise a host to which users of this host are SSH'ing into, and then to set up a trojaned version of scp which would overwrite files on this host 

The remote host is running a version of the SSH server which is older than version 3.1.5 or 3.2.2. There is a vulnerability in this version which may allow a user to obtain higher privileges due to a flaw in the way setsid() is used.

The remote host is running F-Secure SSH.  This version contains a bug which may allow a user to log in using a password even though the server policy disallows it.  An attacker may exploit this flaw to set up a dictionary attack against the remote SSH server and eventually get access to this host. 

ID	Name	Severity
1979	OpenSSH Client < 2.3.0 X11 Unauthorized Remote Forwarding	high
1978	SSH < 1.2.25 CBC/CFB Data Stream Injection	medium
1977	SSH < 1.2.28 Kerberos NFS Share Ticket Disclosure	low
1976	SSH Secure-RPC Weak Encrypted Authentication Key Recovery (deprecated)	low
1975	SSH Multiple Vulnerabilities	critical
1974	SSH Multiple Vulnerabilities	critical
1973	SSH Multiple Vulnerabilities	critical
1972	SSH RSAREF Library Multiple Overflows (deprecated)	high
1971	PKCS#1 Version 1.5 Session Key Retrieval	medium
1970	scp < 2.1 Traversal File Create/Overwrite	medium
1969	SSH < 3.1.5 / 3.2.2 setsid() Privilege Escalation	high
1968	SSH Client Detection	info
1967	SSH Server Detection	info
1966	F-Secure SSH Password Authentication Policy Evasion	medium

Detections

Analytics

SSH Family for Nessus Network Monitor

high

medium

low

low

critical

critical

critical

high

medium

medium

high

info

info

medium