"Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695.

According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1. Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH. Since NNM solely relied on the banner of the remote SSH server to perform this check, this might be a false positive. 

If you are running a RedHat host, make sure that the command :

rpm -q openssh-server

returns :

openssh-server-3.1p1-13 (RedHat 7.x) openssh-server-3.4p1-7 (RedHat 8.0) openssh-server-3.5p1-11 (RedHat 9)

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

Several bugs have been found in OpenSSH's buffer handling. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

DSA-383-2: This advisory is an addition to the earlier DSA-383-1 advisory: Solar Designer found four more bugs in OpenSSH that may be exploitable.

A bug has been found in OpenSSH's buffer handling where a buffer could be marked as grown when the actual reallocation failed.

DSA-382-2: This advisory is an addition to the earlier DSA-382-1 advisory: two more buffer handling problems have been found in addition to the one described in DSA-382-1. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

DSA-382-3: This advisory is an addition to the earlier DSA-382-1 and DSA-382-2 advisories: Solar Designer found four more bugs in OpenSSH that may be exploitable.

Updated OpenSSH packages are now available that fix bugs that may be remotely exploitable.

[Updated 17 Sep 2003] Updated packages are now available to fix additional buffer manipulation problems which were fixed in OpenSSH 3.7.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0695 to these additional issues.

We have also included fixes from Solar Designer for some additional memory bugs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0682 to these issues.

OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login sessions and port forwarding, among other functions.

The OpenSSH team has announced a bug which affects the OpenSSH buffer handling code. This bug has the potential of being remotely exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0693 to this issue.

All users of OpenSSH should immediately apply this update which contains a backported fix for this issue.

According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1.  Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH.  Since Nessus solely relied on the banner of the remote SSH server to perform this check, this might be a false positive. 

If you are running a RedHat host, make sure that the command :

  rpm -q openssh-server

returns :

  openssh-server-3.1p1-13 (RedHat 7.x)   openssh-server-3.4p1-7  (RedHat 8.0)   openssh-server-3.5p1-11 (RedHat 9)

ID	Name	Product	Family	Severity
701168	OpenSSH < 3.7.1 Multiple Vulnerabilities	Nessus Network Monitor	SSH	critical
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
15220	Debian DSA-383-2 : ssh-krb5 - possible remote vulnerability	Nessus	Debian Local Security Checks	critical
15219	Debian DSA-382-3 : ssh - possible remote vulnerability	Nessus	Debian Local Security Checks	critical
12421	RHEL 2.1 : openssh (RHSA-2003:280)	Nessus	Red Hat Local Security Checks	critical
11837	OpenSSH < 3.7.1 Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2003-0682

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical