Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2007-4752 | First vendor Publication | 2007-09-11 |
| Vendor | Cve | Last vendor Modification | 2018-10-15 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4752 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10809 | |||
| Oval ID: | oval:org.mitre.oval:def:10809 | ||
| Title: | ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. | ||
| Description: | ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-4752 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17500 | |||
| Oval ID: | oval:org.mitre.oval:def:17500 | ||
| Title: | USN-566-1 -- openssh vulnerability | ||
| Description: | Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-566-1 CVE-2007-4752 | Version: | 5 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | openssh |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18593 | |||
| Oval ID: | oval:org.mitre.oval:def:18593 | ||
| Title: | DSA-1576-1 openssh openssh-blacklist - predictable randomness | ||
| Description: | The recently announced vulnerability in Debian's openssl package (<a href="/security/2008/dsa-1571">DSA-1571-1</a>, <a href="http://security-tracker.debian.org/tracker/CVE-2008-0166">CVE-2008-0166</a>) indirectly affects OpenSSH. As a result, all user and host keys generated using broken versions of the openssl package must be considered untrustworthy, even after the openssl update has been applied. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1576-1 CVE-2008-0166 CVE-2008-1483 CVE-2007-4752 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | openssh |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:5599 | |||
| Oval ID: | oval:org.mitre.oval:def:5599 | ||
| Title: | HP-UX Running HP Secure Shell, Remotely Gain Extended Privileges | ||
| Description: | ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-4752 | Version: | 9 |
| Platform(s): | HP-UX 11 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7978 | |||
| Oval ID: | oval:org.mitre.oval:def:7978 | ||
| Title: | DSA-1576 openssh -- predictable random number generator | ||
| Description: | The recently announced vulnerability in Debian's openssl package (DSA-1571-1, CVE-2008-0166) indirectly affects OpenSSH. As a result, all user and host keys generated using broken versions of the openssl package must be considered untrustworthy, even after the openssl update has been applied. 1. Install the security updates This update contains a dependency on the openssl update and will automatically install a corrected version of the libssl0.9.8 package, and a new package openssh-blacklist. Once the update is applied, weak user keys will be automatically rejected where possible (though they cannot be detected in all cases). If you are using such keys for user authentication, they will immediately stop working and will need to be replaced (see step 3). OpenSSH host keys can be automatically regenerated when the OpenSSH security update is applied. The update will prompt for confirmation before taking this step. 2. Update OpenSSH known_hosts files The regeneration of host keys will cause a warning to be displayed when connecting to the system using SSH until the host key is updated in the known_hosts file. The warning will look like this: In this case, the host key has simply been changed, and you should update the relevant known_hosts file as indicated in the error message. It is recommended that you use a trustworthy channel to exchange the server key. It is found in the file /etc/ssh/ssh_host_rsa_key.pub on the server; its fingerprint can be printed using the command: ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub In addition to user-specific known_hosts files, there may be a system-wide known hosts file /etc/ssh/ssh_known_hosts. This is file is used both by the ssh client and by sshd for the hosts.equiv functionality. This file needs to be updated as well. 3. Check all OpenSSH user keys The safest course of action is to regenerate all OpenSSH user keys, except where it can be established to a high degree of certainty that the key was generated on an unaffected system. Check whether your key is affected by running the ssh-vulnkey tool, included in the security update. By default, ssh-vulnkey will check the standard location for user keys (~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity), your authorised_keys file (~/.ssh/authorised_keys and ~/.ssh/authorised_keys2), and the system's host keys (/etc/ssh/ssh_host_dsa_key and /etc/ssh/ssh_host_rsa_key). To check all your own keys, assuming they are in the standard locations (~/.ssh/id_rsa, ~/.ssh/id_dsa, or ~/.ssh/identity): ssh-vulnkey To check all keys on your system: sudo ssh-vulnkey -a To check a key in a non-standard location: ssh-vulnkey /path/to/key If ssh-vulnkey says "Unknown (no blacklist information)", then it has no information about whether that key is affected. In this case, you can examine the modification time (mtime) of the file using "ls -l". Keys generated before September 2006 are not affected. Keep in mind that, although unlikely, backup procedures may have changed the file date back in time (or the system clock may have been incorrectly set). If in doubt, generate a new key and remove the old one from any servers. 4. Regenerate any affected user keys OpenSSH keys used for user authentication must be manually regenerated, including those which may have since been transferred to a different system after being generated. New keys can be generated using ssh-keygen, e.g.: 5. Update authorised_keys files (if necessary) Once the user keys have been regenerated, the relevant public keys must be propagated to any authorised_keys files (and authorised_keys2 files, if applicable) on remote systems. Be sure to delete the lines containing old keys from those files. In addition to countermeasures to mitigate the randomness vulnerability, this OpenSSH update fixes several other vulnerabilities: CVE-2008-1483: Timo Juhani Lindfors discovered that, when using X11 forwarding, the SSH client selects an X11 forwarding port without ensuring that it can be bound on all address families. If the system is configured with IPv6 (even if it does not have working IPv6 connectivity), this could allow a local attacker on the remote server to hijack X11 forwarding. CVE-2007-4752: Jan Pechanec discovered that ssh falls back to creating a trusted X11 cookie if creating an untrusted cookie fails, potentially exposing the local display to a malicious remote server when using X11 forwarding. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1576 CVE-2008-0166 CVE-2008-1483 CVE-2007-4752 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | openssh |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-10 | Name : SLES9: Security update for OpenSSH File : nvt/sles9p5016761.nasl |
| 2009-05-05 | Name : HP-UX Update for HP Secure Shell HPSBUX02287 File : nvt/gb_hp_ux_HPSBUX02287.nasl |
| 2009-04-09 | Name : Mandriva Update for openssh MDKSA-2007:236 (openssh) File : nvt/gb_mandriva_MDKSA_2007_236.nasl |
| 2009-03-23 | Name : Ubuntu Update for openssh vulnerability USN-566-1 File : nvt/gb_ubuntu_USN_566_1.nasl |
| 2009-03-06 | Name : RedHat Update for openssh RHSA-2008:0855-01 File : nvt/gb_RHSA-2008_0855-01_openssh.nasl |
| 2009-02-27 | Name : Fedora Update for openssh FEDORA-2007-715 File : nvt/gb_fedora_2007_715_openssh_fc6.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200711-02 (openssh) File : nvt/glsa_200711_02.nasl |
| 2008-05-27 | Name : Debian Security Advisory DSA 1576-1 (openssh) File : nvt/deb_1576_1.nasl |
| 2008-05-27 | Name : Debian Security Advisory DSA 1576-2 (openssh) File : nvt/deb_1576_2.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2007-255-01 openssh File : nvt/esoft_slk_ssa_2007_255_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 43371 | OpenSSH Trusted X11 Cookie Connection Policy Bypass |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2008-08-28 | IAVM : 2008-T-0046 - Red Hat OpenSSH Vulnerability Severity : Category II - VMSKEY : V0017144 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0855.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080822_openssh_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2011-10-04 | Name : Remote attackers may be able to bypass authentication. File : openssh_47.nasl - Type : ACT_GATHER_INFO |
| 2011-08-29 | Name : The SSH service running on the remote host has an information disclosure vuln... File : sunssh_plaintext_recovery.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0855.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11931.nasl - Type : ACT_GATHER_INFO |
| 2008-08-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0855.nasl - Type : ACT_GATHER_INFO |
| 2008-05-19 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1576.nasl - Type : ACT_GATHER_INFO |
| 2008-03-19 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-002.nasl - Type : ACT_GATHER_INFO |
| 2008-01-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-566-1.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_openssh-4580.nasl - Type : ACT_GATHER_INFO |
| 2007-12-07 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-236.nasl - Type : ACT_GATHER_INFO |
| 2007-11-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-02.nasl - Type : ACT_GATHER_INFO |
| 2007-10-30 | Name : The remote openSUSE host is missing a security update. File : suse_openssh-4579.nasl - Type : ACT_GATHER_INFO |
| 2007-10-16 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-715.nasl - Type : ACT_GATHER_INFO |
| 2007-09-14 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-255-01.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-02-02 12:07:05 |
|
| 2024-02-02 01:07:17 |
|
| 2024-02-01 12:02:24 |
|
| 2023-09-06 01:06:18 |
|
| 2023-09-05 12:06:48 |
|
| 2023-09-05 01:02:15 |
|
| 2023-09-03 01:06:41 |
|
| 2023-09-02 12:06:55 |
|
| 2023-09-02 01:02:16 |
|
| 2023-08-13 01:06:13 |
|
| 2023-08-12 12:08:01 |
|
| 2023-08-12 01:02:16 |
|
| 2023-08-11 12:06:57 |
|
| 2023-08-11 01:02:21 |
|
| 2023-08-07 01:06:15 |
|
| 2023-08-06 12:06:38 |
|
| 2023-08-06 01:02:17 |
|
| 2023-08-05 01:06:10 |
|
| 2023-08-04 12:06:44 |
|
| 2023-08-04 01:02:20 |
|
| 2023-07-15 01:06:36 |
|
| 2023-07-14 12:06:43 |
|
| 2023-07-14 01:02:18 |
|
| 2023-03-29 12:06:11 |
|
| 2023-03-29 01:07:31 |
|
| 2023-03-28 12:02:23 |
|
| 2022-10-12 01:05:46 |
|
| 2022-10-11 12:05:57 |
|
| 2022-10-11 01:02:08 |
|
| 2022-08-06 12:05:43 |
|
| 2022-08-05 12:05:37 |
|
| 2021-05-04 12:06:22 |
|
| 2021-04-22 01:06:55 |
|
| 2020-07-25 12:02:58 |
|
| 2020-05-23 01:38:44 |
|
| 2020-05-23 00:20:25 |
|
| 2019-10-09 01:02:20 |
|
| 2019-03-19 12:02:33 |
|
| 2018-10-16 00:19:14 |
|
| 2017-09-29 09:23:12 |
|
| 2017-07-29 12:02:31 |
|
| 2016-04-26 16:34:25 |
|
| 2014-08-09 05:23:50 |
|
| 2014-02-17 10:41:41 |
|
| 2013-11-11 12:37:45 |
|
| 2013-08-20 17:22:17 |
|
| 2013-05-11 10:36:01 |
|
