The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol. 

These protocols are not completely cryptographically safe so they should not be used.

リモート SSH デーモンは、SSH プロトコルのバージョン 1.33 および/または 1.5 を使用して作られた接続をサポートします。 

これらのプロトコルは、暗号的に完全に安全ではないため、使用してはなりません。

バナーによると、リモートホストで 2.5.2 / 2.5.2p2 より前のバージョンの OpenSSH が実行されているようです。このため、報告されているところによれば、このバージョンには、SSHプロトコル（バージョン1および2の両方）の実装に弱点が含まれています。これらの弱点により、攻撃者は、パスワードの長さおよび長さの範囲を盗聴し（これにより総当たりでのパスワード推測が簡単になります）、RSAまたはDSA認証が使用されているか、RSA認証でのauthorized_keysの数、シェルコマンドの長さを判別できることがあります。

远程 SSH 后台程序支持使用 SSH 协议 1.33 和/或 1.5 版建立的连接。 

这些协议在密码学意义上并非完全安全，因此不应使用它们。

根据其标题，远程主机似乎正在运行早于 2.5.2 / 2.5.2p2 的 OpenSSH 版本。因此，有报告称其同时在 SSH 协议版本 1 和 2 的实现中包含漏洞。这些漏洞可允许攻击者嗅探密码长度和长度范围（这样会更便于暴力密码猜测）、确定正在使用 RSA 还是 DSA 身份验证、RSA 身份验证中 authorized_key 的数量以及/ 或者 shell 命令的长度。

根據其標題，遠端主機執行的 OpenSSH 版本似乎比 2.5.2 / 2.5.2p2 舊。因此，據報版本 1 和 2 的 SSH 通訊協定實作中包含多個弱點。攻擊者可利用這些弱點探查密碼長度及長度範圍 (如此更容易進行暴力密碼猜測)，判斷是否使用 RSA 或 DSA 驗證，以及判斷 RSA 驗證中的 authorized_keys 數目和/或 shell 命令的長度。

リモートホストで実行されているバージョンの SunSSH に情報漏洩脆弱性があります。SSH の仕様の設計上の欠陥により、中間攻撃者が、標準構成の SSH 保護接続から最大 32 ビットまでの平文を回収できることがあります。攻撃者はこれを悪用して、機密情報にアクセスすることがあります。

このバージョンの SunSSH はいくつかのその他の問題の影響も受けやすくなっていますが、Nessus はそれらの問題をテストしていないことに、注意してください。

远程主机上运行的 SunSSH 版本存在信息泄露漏洞。SSH 规范中的设计缺陷可允许中间人攻击者从标准配置的受 SSH 保护的连接中恢复多达 32 位的明文。攻击者可利用这一点获取敏感信息的访问权限。

请注意，此 SunSSH 版本也易于发生多个其他问题，但 Nessus 未对其进行测试。

According to its version number, the remote host is a Cisco router or switch running a vulnerable SSH daemon.

By exploiting weaknesses in the SSH protocol, it is possible to insert arbitrary commands into an established SSH session, collect information that may help in brute-force key recovery, or brute-force a session key.

According to its banner, the remote host appears to be running a version of OpenSSH earlier than 2.5.2 / 2.5.2p2. It, therefore, reportedly contains weaknesses in its implementation of the SSH protocol, both versions 1 and 2.  These weaknesses could allow an attacker to sniff password lengths, and ranges of length (this could make brute-force password guessing easier), determine whether RSA or DSA authentication is being used, the number of authorized_keys in RSA authentication and/or the length of shell commands.

- Versions of OpenSSH prior to 2.3.0 are vulnerable to a     remote arbitrary memory overwrite attack which may lead     to a root exploit.
  - CORE-SDI has described a problem with regards to RSA key     exchange and a Bleichenbacher attack to gather the     session key from an ssh session.

Both of these issues have been corrected in our ssh package 1.2.3-9.2.
We recommend you upgrade your openssh package immediately.

遠端主機上安裝的 SunSSH 版本有資訊洩漏弱點。SSH 規格的設計瑕疵允許攔截式攻擊者在標準組態中從 SSH 受保護的連線復原多達 32 位元的純文字。攻擊者可惡意利用此弱點來存取敏感資訊。

請注意，此版本的 SunSSH 也容易發生其他多個問題，但 Nessus 並未測試這些問題。

- People at WireX have found several potential insecure     uses of temporary files in programs provided by INN2.
    Some of them only lead to a vulnerability to symlink     attacks if the temporary directory was set to /tmp or     /var/tmp, which is the case in many installations, at     least in Debian packages. An attacker could overwrite     any file owned by the news system administrator, i.e.
    owned by news.news.
  - Michal Zalewski found an exploitable buffer overflow     with regard to cancel messages and their verification.
    This bug did only show up if 'verifycancels' was enabled     in inn.conf which is not the default and has been     disrecommended by upstream.

  - Andi Kleen found a bug in INN2 that makes innd crash for     two byte headers. There is a chance this can only be     exploited with uucp.

We have received reports that the 'SSH CRC-32 compensation attack detector vulnerability' is being actively exploited. This is the same integer type error previously corrected for OpenSSH in DSA-027-1.
OpenSSH (the Debian ssh package) was fixed at that time, but ssh-nonfree and ssh-socks were not.

Though packages in the non-free section of the archive are not officially supported by the Debian project, we are taking the unusual step of releasing updated ssh-nonfree/ssh-socks packages for those users who have not yet migrated to OpenSSH. However, we do recommend that our users migrate to the regularly supported, DFSG-free 'ssh' package as soon as possible. ssh 1.2.3-9.3 is the OpenSSH package available in Debian 2.2r4.

The fixed ssh-nonfree/ssh-socks packages are available in version 1.2.27-6.2 for use with Debian 2.2 (potato) and version 1.2.27-8 for use with the Debian unstable/testing distribution. Note that the new ssh-nonfree/ssh-socks packages remove the setuid bit from the ssh binary, disabling rhosts-rsa authentication. If you need this functionality, run

chmod u+s /usr/bin/ssh1

after installing the new package.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is using version 1.5 of the SSH protocol. This version allows a remote attacker to decrypt and/or alter traffic via an attack against PKCS#1 version 1.5, called the 'Bleichenbacher' attack. OpenSSH up to version 2.3.0, AppGate and SSH Communications Security ssh1 update to version 1.2.31 are vulnerable to this attack. 

ID	Name	Product	Family	Published	Updated	Severity
10882	SSH Protocol Version 1 Session Key Retrieval	Nessus	General	3/6/2002	10/27/2023	high
10882	SSH プロトコルバージョン 1 セッションキー検索	Nessus	General	3/6/2002	10/27/2023	high
44068	OpenSSH < 2.5.2 / 2.5.2p2 の複数の情報漏洩脆弱性	Nessus	Misc.	10/4/2011	3/27/2024	medium
10882	SSH 协议版本 1 会话密钥检索	Nessus	General	3/6/2002	10/27/2023	high
44068	OpenSSH < 2.5.2 / 2.5.2p2 多种信息泄露漏洞	Nessus	Misc.	10/4/2011	3/27/2024	medium
44068	OpenSSH < 2.5.2 / 2.5.2p2 多個資訊洩漏弱點	Nessus	Misc.	10/4/2011	3/27/2024	medium
55992	SunSSH < 1.1.1 / 1.3 CBC の平文での漏洩	Nessus	Misc.	8/29/2011	9/21/2020	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 明文泄露	Nessus	Misc.	8/29/2011	9/21/2020	critical
10972	Cisco Devices Multiple SSH Information Disclosure Vulnerabilities	Nessus	CISCO	6/5/2002	11/15/2018	high
44068	OpenSSH < 2.5.2 / 2.5.2p2 Multiple Information Disclosure Vulnerabilities	Nessus	Misc.	10/4/2011	3/27/2024	medium
14864	Debian DSA-027-1 : OpenSSH - remote exploit	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	critical
55992	SunSSH < 1.1.1 / 1.3 CBC 純文字洩漏	Nessus	Misc.	8/29/2011	9/21/2020	critical
14860	Debian DSA-023-1 : inn2 - local tempfile vulnerabilities	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	medium
14923	Debian DSA-086-1 : ssh-nonfree - remote root exploit	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	critical
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	8/29/2011	9/21/2020	critical
1971	PKCS#1 Version 1.5 Session Key Retrieval	Nessus Network Monitor	SSH	8/20/2004	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

medium

high

medium

medium

critical

critical

high

medium

critical

critical

medium

critical

critical

medium