Executive Summary

Summary
Title openssh security update
Informations
Name RHSA-2006:0298 First vendor Publication 2006-07-20
Vendor RedHat Last vendor Modification 2006-07-20
Severity (Vendor) Low Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated openssh packages that fix bugs in sshd are now available for Red Hat Enterprise Linux 3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

An arbitrary command execution flaw was discovered in the way scp copies files locally. It is possible for a local attacker to create a file with a carefully crafted name that could execute arbitrary commands as the user running scp to copy files locally. (CVE-2006-0225)

The SSH daemon, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address. (CVE-2003-0386)

The following issues have also been fixed in this update:

* If the sshd service was stopped using the sshd init script while the
main sshd daemon was not running, the init script would kill other sshd
processes, such as the running sessions. For example, this could happen
when the 'service sshd stop' command was issued twice.

* When privilege separation was enabled, the last login message was printed
only for the root user.

* The sshd daemon was sending messages to the system log from a signal
handler when debug logging was enabled. This could cause a deadlock of
the user's connection.

All users of openssh should upgrade to these updated packages, which resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

164661 - CVE-2003-0386 host based access bypass 167886 - init script kills all running sshd's if listening server is stopped 170463 - CVE-2006-0225 local to local copy uses shell expansion twice 172564 - I can't see "Last login" message after logged via ssh

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2006-0298.html

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1138
 
Oval ID: oval:org.mitre.oval:def:1138
Title: Security Vulnerability Relating to scp(1) Command May Allow Attackers to Execute Arbitrary Commands
Description: scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Family: unix Class: vulnerability
Reference(s): CVE-2006-0225
Version: 3
Platform(s): Sun Solaris 9
Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9894
 
Oval ID: oval:org.mitre.oval:def:9894
Title: OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.
Description: OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.
Family: unix Class: vulnerability
Reference(s): CVE-2003-0386
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9962
 
Oval ID: oval:org.mitre.oval:def:9962
Title: scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Description: scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
Family: unix Class: vulnerability
Reference(s): CVE-2006-0225
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 33

OpenVAS Exploits

Date Description
2010-02-03 Name : Solaris Update for Kernel 122300-48
File : nvt/gb_solaris_122300_48.nasl
2010-02-03 Name : Solaris Update for Kernel 122301-48
File : nvt/gb_solaris_122301_48.nasl
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-10-13 Name : Solaris Update for /usr/bin/ssh 114356-19
File : nvt/gb_solaris_114356_19.nasl
2009-10-13 Name : Solaris Update for /usr/bin/ssh 114357-18
File : nvt/gb_solaris_114357_18.nasl
2009-10-10 Name : SLES9: Security update for OpenSSH
File : nvt/sles9p5021162.nasl
2009-06-03 Name : Solaris Update for /usr/bin/ssh 114356-18
File : nvt/gb_solaris_114356_18.nasl
2009-06-03 Name : Solaris Update for /usr/bin/ssh 114357-17
File : nvt/gb_solaris_114357_17.nasl
2009-06-03 Name : Solaris Update for kernel 120011-14
File : nvt/gb_solaris_120011_14.nasl
2009-06-03 Name : Solaris Update for kernel 120012-14
File : nvt/gb_solaris_120012_14.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200602-11 (OpenSSH)
File : nvt/glsa_200602_11.nasl
0000-00-00 Name : Slackware Advisory SSA:2006-045-06 openssh
File : nvt/esoft_slk_ssa_2006_045_06.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
22692 OpenSSH scp Command Line Filename Processing Command Injection

OpenSSH contains a flaw that may allow an attacker to execute arbitrary commands. The flaw is due to the way OpenSSH's scp utility handles file names during local-to-local copies. During the file name expansion, the utility does not properly sanitize filenames allowing a crafted file name with shell meta-characters. This can be used to trick a user into executing arbitrary commands under with a different set of (potentially higher) privileges.
2112 OpenSSH Reverse DNS Lookup Bypass

OpenSSH could allow a remote attacker to gain unauthorized access to the network. If the 'VeriftyReverseMapping' flag is disabled, which is the default setting, a remote attacker using their own DNS (Domain Name System) server to control reverse lookup responses can employ DNS spoofing techniques to bypass login restrictions and gain unauthorized access to the network.

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-08-16 IAVM : 2012-A-0136 - Multiple Vulnerabilities in Juniper Network Management Products
Severity : Category I - VMSKEY : V0033662

Nessus® Vulnerability Scanner

Date Description
2013-09-13 Name : The remote host is affected by multiple vulnerabilities.
File : juniper_nsm_2012_1.nasl - Type : ACT_GATHER_INFO
2011-10-04 Name : The version of SSH running on the remote host has a command injection vulnera...
File : openssh_43.nasl - Type : ACT_GATHER_INFO
2011-08-29 Name : The SSH service running on the remote host has an information disclosure vuln...
File : sunssh_plaintext_recovery.nasl - Type : ACT_GATHER_INFO
2007-03-13 Name : The remote host is missing a Mac OS X update which fixes a security issue.
File : macosx_10_4_9.nasl - Type : ACT_GATHER_INFO
2006-09-29 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2006-0698.nasl - Type : ACT_GATHER_INFO
2006-08-04 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2006-0298.nasl - Type : ACT_GATHER_INFO
2006-07-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2006-0298.nasl - Type : ACT_GATHER_INFO
2006-07-05 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2006-0044.nasl - Type : ACT_GATHER_INFO
2006-03-13 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-255-1.nasl - Type : ACT_GATHER_INFO
2006-03-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2006-0044.nasl - Type : ACT_GATHER_INFO
2006-02-21 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200602-11.nasl - Type : ACT_GATHER_INFO
2006-02-15 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2006-045-06.nasl - Type : ACT_GATHER_INFO
2006-02-15 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2006_008.nasl - Type : ACT_GATHER_INFO
2006-02-10 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2006-034.nasl - Type : ACT_GATHER_INFO
2006-01-24 Name : The remote Fedora Core host is missing a security update.
File : fedora_2006-056.nasl - Type : ACT_GATHER_INFO
2003-06-10 Name : The remote host has an application that is affected by DNS lookup bypass vuln...
File : openssh_rev_dns_lookup_bypass.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:49:59
  • Multiple Updates