The remote host is running a version of OpenSSH prior to 4.7 is affected by an authentication bypass vulnerability. In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie instead. This allows attackers to violate intended policy and gain privileges by causing their X client to be treated as trusted.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to
    determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a
    different response if the user account exists, a similar issue to CVE-2001-1483. (CVE-2007-2243)

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

When OpenSSH has S/KEY authentication enabled, it is possible to remotely determine if an account configured for S/KEY authentication exists. 

Note that Nessus has not attempted to exploit the issue but has instead only checked if OpenSSH is running on the remote host. As a result, it will not detect if the remote host has implemented a workaround.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to     determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a     different response if the user account exists, a similar issue to CVE-2001-1483. (CVE-2007-2243)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the banner, OpenSSH earlier than 4.7 is running on the remote host.  Such versions contain an authentication bypass vulnerability.  In the event that OpenSSH cannot create an untrusted cookie for X, for example due to the temporary partition being full, it will use a trusted cookie instead.  This allows attackers to violate intended policy and gain privileges by causing their X client to be treated as trusted.

ID	Name	Product	Family	Published	Updated	Severity
4209	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	Nessus Network Monitor	SSH	9/11/2007	3/6/2019	high
462950	Echo: openssh: security update to 1:9.2p1-2+deb12u6	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/2/2026	medium
462950	Echo: openssh: security update to 1:9.2p1-2+deb12u6	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/2/2026	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	8/29/2011	9/21/2020	critical
17704	OpenSSH S/KEY Authentication Account Enumeration	Nessus	Misc.	11/18/2011	3/27/2024	medium
253829	Linux Distros Unpatched Vulnerability : CVE-2007-2243	Nessus	Misc.	8/24/2025	9/1/2026	medium
44078	OpenSSH < 4.7 Trusted X11 Cookie Connection Policy Bypass	Nessus	Misc.	10/4/2011	3/27/2024	high

Detections

Analytics

Plugins Search

high

medium

medium

critical

medium

medium

high