The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K04305530 advisory.

  - ** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as     demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated     that they intentionally omit validation of anomalous argument transfers because that could stand a     great chance of breaking existing workflows. (CVE-2020-15778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202212-06 (OpenSSH: Multiple Vulnerabilities)

  - ** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as     demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated     that they intentionally omit validation of anomalous argument transfers because that could stand a     great chance of breaking existing workflows. (CVE-2020-15778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the openssh packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** scp in OpenSSH through 8.3p1 allows     command injection in the scp.c toremote function, as     demonstrated by backtick characters in the destination     argument. NOTE: the vendor reportedly has stated that     they intentionally omit validation of 'anomalous     argument transfers' because that could 'stand a great     chance of breaking existing workflows.'(CVE-2020-15778)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of OpenSSH running on the remote host is potentially affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: loading of untrusted PKCS#11 modules in ssh-agent (CVE-2016-10009)

  - openssh: scp allows command injection when using backtick characters in the destination argument     (CVE-2020-15778)

  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer     contents, which might allow local users to obtain sensitive private-key information by leveraging access     to a privilege-separated child process. (CVE-2016-10011)

  - The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4     does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain     privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and     m_zlib data structures. (CVE-2016-10012)

  - sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference     and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c     and packet.c. (CVE-2016-10708)

  - OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username     and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a     challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not     recognize user enumeration as a vulnerability for this product (CVE-2016-20012)

  - The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths     for password authentication, which allows remote attackers to cause a denial of service (crypt CPU     consumption) via a long string. (CVE-2016-6515)

  - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions     via the filename of . or an empty filename. The impact is modifying the permissions of the target     directory on the client side. (CVE-2018-20685)

  - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a     malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client     output, e.g., by using ANSI control codes to hide additional files being transferred. This affects     refresh_progress_meter() in progressmeter.c. (CVE-2019-6109)

  - In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious     server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control     codes to hide additional files being transferred. (CVE-2019-6110)

  - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the     server chooses which files/directories are sent to the client. However, the scp client only performs     cursory validation of the object name returned (only directory traversal attacks are prevented). A     malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client     target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as     well (for example, to overwrite the .ssh/authorized_keys file). (CVE-2019-6111)

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

  - sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows     privilege escalation because supplemental groups are not initialized as expected. Helper programs for     AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group     memberships of the sshd process, if the configuration specifies running the command as a different user.
    (CVE-2021-41617)

  - In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell     metacharacters, and this name is referenced by an expansion token in certain situations. For example, an     untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
    (CVE-2023-51385)

  - OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for     authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not     resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-     location in which the attacker has user privileges. (CVE-2023-51767)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The IBM Spectrum Protect Plus running on the remote host is affected by a remote command injection vulnerability due to improper input validation in the remote function in scp.c. An unauthenticated, remote attacker can exploit this, by using backtick characters in the destination argument, to execute arbitrary commands on the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: possible fallback from untrusted to trusted X11 forwarding (CVE-2016-1908)

  - Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote     attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
    (CVE-2016-10009)

  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer     contents, which might allow local users to obtain sensitive private-key information by leveraging access     to a privilege-separated child process. (CVE-2016-10011)

  - The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4     does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain     privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and     m_zlib data structures. (CVE-2016-10012)

  - sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference     and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c     and packet.c. (CVE-2016-10708)

  - Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote     authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related     to the (1) do_authenticated1 and (2) session_x11_req functions. (CVE-2016-3115)

  - sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH     hashing on a static password when the username does not exist, which allows remote attackers to enumerate     users by leveraging the timing difference between responses when a large password is provided.
    (CVE-2016-6210)

  - The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths     for password authentication, which allows remote attackers to cause a denial of service (crypt CPU     consumption) via a long string. (CVE-2016-6515)

  - OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an     invalid authenticating user until after the packet containing the request has been fully parsed, related     to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (CVE-2018-15473)

  - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions     via the filename of . or an empty filename. The impact is modifying the permissions of the target     directory on the client side. (CVE-2018-20685)

  - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a     malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client     output, e.g., by using ANSI control codes to hide additional files being transferred. This affects     refresh_progress_meter() in progressmeter.c. (CVE-2019-6109)

  - In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious     server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control     codes to hide additional files being transferred. (CVE-2019-6110)

  - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the     server chooses which files/directories are sent to the client. However, the scp client only performs     cursory validation of the object name returned (only directory traversal attacks are prevented). A     malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client     target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as     well (for example, to overwrite the .ssh/authorized_keys file). (CVE-2019-6111)

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

  - scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by     backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they     intentionally omit validation of anomalous argument transfers because that could stand a great chance     of breaking existing workflows. (CVE-2020-15778)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - scp in OpenSSH through 8.3p1 allows command injection     in the scp.c toremote function, as demonstrated by     backtick characters in the destination argument. NOTE:
    the vendor reportedly has stated that they     intentionally omit validation of 'anomalous argument     transfers' because that could 'stand a great chance of     breaking existing workflows.'(CVE-2020-15778)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - scp in OpenSSH through 8.3p1 allows command injection     in scp.c remote function, as demonstrated by backtick     characters in the destination argument. NOTE: the     vendor reportedly has stated that they intentionally     omit validation of 'anomalous argument transfers'     because that could 'stand a great chance of breaking     existing workflows.'(CVE-2020-15778)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
179676	F5 Networks BIG-IP : SCP vulnerability (K04305530)	Nessus	F5 Networks Local Security Checks	8/11/2023	5/7/2024	high
169409	GLSA-202212-06 : OpenSSH: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	12/28/2022	9/11/2023	high
151319	EulerOS Virtualization for ARM 64 3.0.2.0 : openssh (EulerOS-SA-2021-2097)	Nessus	Huawei Local Security Checks	7/2/2021	12/11/2023	high
159492	OpenSSH PCI Disputed Vulnerabilities.	Nessus	Misc.	4/4/2022	3/27/2024	high
195377	RHEL 6 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
151155	IBM Spectrum Protect Plus OpenSSH Remote Command Injection	Nessus	Misc.	6/30/2021	12/12/2023	high
195388	RHEL 5 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/13/2024	critical
151035	EulerOS 2.0 SP8 : openssh (EulerOS-SA-2021-1993)	Nessus	Huawei Local Security Checks	6/28/2021	12/12/2023	high
151168	EulerOS Virtualization for ARM 64 3.0.6.0 : openssh (EulerOS-SA-2021-2018)	Nessus	Huawei Local Security Checks	6/30/2021	12/12/2023	high
151235	EulerOS Virtualization 3.0.6.6 : openssh (EulerOS-SA-2021-2039)	Nessus	Huawei Local Security Checks	7/1/2021	12/11/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

high

high

high