Executive Summary
| Summary | |
|---|---|
| Title | openssh security and bug fix update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2007:0540 | First vendor Publication | 2007-11-07 |
| Vendor | RedHat | Last vendor Modification | 2007-11-07 |
| Severity (Vendor) | Moderate | Revision | 04 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated openssh packages that fix a security issue and various bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server. A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102) A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in the OpenSSH server, a remote attacker was potentially able to determine if a username is valid. (CVE-2006-5052) The following bugs in SELinux MLS (Multi-Level Security) support has also been fixed in this update: * It was sometimes not possible to select a SELinux role and level when logging in using ssh. * If the user obtained a non-default SELinux role or level, the role change was not recorded in the audit subsystem. * In some cases, on labeled networks, sshd allowed logins from level ranges it should not allow. The updated packages also contain experimental support for using private keys stored in PKCS#11 tokens for client authentication. The support is provided through the NSS (Network Security Services) library. All users of openssh should upgrade to these updated packages, which contain patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 227733 - [LSPP] unable to ssh into a system as root/auditadm_r 229278 - LSPP: ssh-mls allows a level through that it should not 231695 - LSPP: user unable to ssh to system with user/role/level context 234638 - CVE-2006-5052 GSSAPI information leak 234951 - [LSPP] openssh server fails to parse level correctly 248059 - CVE-2007-3102 audit logging of failed logins |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2007-0540.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10178 | |||
| Oval ID: | oval:org.mitre.oval:def:10178 | ||
| Title: | Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort." | ||
| Description: | Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort." | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-5052 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11124 | |||
| Oval ID: | oval:org.mitre.oval:def:11124 | ||
| Title: | Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information. | ||
| Description: | Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3102 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22147 | |||
| Oval ID: | oval:org.mitre.oval:def:22147 | ||
| Title: | ELSA-2007:0555: pam security, bug fix, and enhancement update (Moderate) | ||
| Description: | Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0555-04 CVE-2007-1716 CVE-2007-3102 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | pam |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22536 | |||
| Oval ID: | oval:org.mitre.oval:def:22536 | ||
| Title: | ELSA-2007:0540: openssh security and bug fix update (Moderate) | ||
| Description: | Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0540-04 CVE-2006-5052 CVE-2007-3102 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | openssh |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-10 | Name : SLES9: Security update for OpenSSH File : nvt/sles9p5019505.nasl |
| 2009-02-27 | Name : Fedora Update for openssh FEDORA-2007-394 File : nvt/gb_fedora_2007_394_openssh_fc6.nasl |
| 2009-02-27 | Name : Fedora Update for openssh FEDORA-2007-395 File : nvt/gb_fedora_2007_395_openssh_fc5.nasl |
| 2009-02-27 | Name : Fedora Update for openssh FEDORA-2007-715 File : nvt/gb_fedora_2007_715_openssh_fc6.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200611-06 (openssh) File : nvt/glsa_200611_06.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-272-02 openssh File : nvt/esoft_slk_ssa_2006_272_02.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 39214 | OpenSSH linux_audit_record_event Crafted Username Audit Log Injection |
| 29266 | OpenSSH GSSAPI Authentication Abort Username Enumeration OpenSSH, when configured to use GSSAPI authentication, is prone to a remote information disclosure weakness. The issue occurs due to the GSSAPI authentication routine responding differently to an attacker who lets the connection proceed normally versus aborting the connection prematurely. This different in the system's response allows an attacker to determine which accounts are valid. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2006-0697.nasl - Type : ACT_GATHER_INFO |
| 2013-06-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0703.nasl - Type : ACT_GATHER_INFO |
| 2013-06-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0737.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071115_pam_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071115_openssh_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071109_pam_on_SL5.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071109_openssh_on_SL5.nasl - Type : ACT_GATHER_INFO |
| 2011-08-29 | Name : The SSH service running on the remote host has an information disclosure vuln... File : sunssh_plaintext_recovery.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_openssh-2184.nasl - Type : ACT_GATHER_INFO |
| 2007-11-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0737.nasl - Type : ACT_GATHER_INFO |
| 2007-11-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0703.nasl - Type : ACT_GATHER_INFO |
| 2007-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0540.nasl - Type : ACT_GATHER_INFO |
| 2007-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0555.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_openssh-2183.nasl - Type : ACT_GATHER_INFO |
| 2007-10-16 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-715.nasl - Type : ACT_GATHER_INFO |
| 2007-04-05 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-395.nasl - Type : ACT_GATHER_INFO |
| 2007-04-05 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-394.nasl - Type : ACT_GATHER_INFO |
| 2007-03-13 | Name : The remote host is missing a Mac OS X update which fixes a security issue. File : macosx_10_4_9.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_062.nasl - Type : ACT_GATHER_INFO |
| 2006-11-20 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200611-06.nasl - Type : ACT_GATHER_INFO |
| 2006-10-02 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0697.nasl - Type : ACT_GATHER_INFO |
| 2006-09-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-272-02.nasl - Type : ACT_GATHER_INFO |
| 2006-09-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0697.nasl - Type : ACT_GATHER_INFO |
| 2006-09-28 | Name : The remote SSH server is affected by multiple vulnerabilities. File : openssh_44.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:50:48 |
|
