OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent.

A vulnerability exists with all versions of OpenSSH prior to 2.3.0 with regards to the X11 forwarding and ssh-agent. If agent or X11 forwarding is disabled in the ssh client configuration, the client does not request these features during session setup. However, when the ssh client receives an actual request asking for access to the ssh-agent, the client fails to check whether this feature has been negotiated during session setup. The client does not check whether the request is in compliance with the client configuration and grants access to the ssh-agent. A similar problem exists in the X11 forwarding implementation.

Update :

The packages announced yesterday for Linux-Mandrake 7.0 and 7.1 did not have PAM support enabled. This meant that the server would not allow logins. These updated packages for 7.0 and 7.1 are now available with PAM support properly enabled.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is running OpenSSH SSH client older than 2.3.0. This version does not properly disable X11 or agent forwarding, which could allow a rogue SSH server to gain access to the X11 display of the client and eavesdrop X11 events.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner. 

The remote host is running a version of the OpenSSH client older than 2.3.0.  Such versions do not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent.

ID	Name	Product	Family	Severity
61854	Mandrake Linux Security Advisory : openssh (MDKSA-2000:068-1)	Nessus	Mandriva Local Security Checks	high
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
1979	OpenSSH Client < 2.3.0 X11 Unauthorized Remote Forwarding	Nessus Network Monitor	SSH	high
11343	OpenSSH Client Unauthorized X11 Remote Forwarding	Nessus	Misc.	high

Detections

Analytics

CVE-2000-1169

critical

Tenable Plugins

high

critical

high

high