A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.

According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1. Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH. Since NNM solely relied on the banner of the remote SSH server to perform this check, this might be a false positive. 

If you are running a RedHat host, make sure that the command :

rpm -q openssh-server

returns :

openssh-server-3.1p1-13 (RedHat 7.x) openssh-server-3.4p1-7 (RedHat 8.0) openssh-server-3.5p1-11 (RedHat 9)

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

Several bugs have been found in OpenSSH's buffer handling. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

DSA-383-2: This advisory is an addition to the earlier DSA-383-1 advisory: Solar Designer found four more bugs in OpenSSH that may be exploitable.

A bug has been found in OpenSSH's buffer handling where a buffer could be marked as grown when the actual reallocation failed.

DSA-382-2: This advisory is an addition to the earlier DSA-382-1 advisory: two more buffer handling problems have been found in addition to the one described in DSA-382-1. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

DSA-382-3: This advisory is an addition to the earlier DSA-382-1 and DSA-382-2 advisories: Solar Designer found four more bugs in OpenSSH that may be exploitable.

The remote host is running a version of OpenSSH that is vulnerable to a flaw in the buffer handling functions which may possibly leading to command execution.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

A buffer management error was discovered in all versions of openssh prior to version 3.7. According to the OpenSSH team's advisory: 'It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs fixed proactively.' There have also been reports of an exploit in the wild.

MandrakeSoft encourages all users to upgrade to these patched openssh packages immediately and to disable sshd until you are able to upgrade if at all possible.

Update :

The OpenSSH developers discovered more, similar, problems and revised the patch to correct these issues. These new packages have the latest patch fix applied.

Updated OpenSSH packages are now available that fix bugs that may be remotely exploitable.

[Updated 17 Sep 2003] Updated packages are now available to fix additional buffer manipulation problems which were fixed in OpenSSH 3.7.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0695 to these additional issues.

We have also included fixes from Solar Designer for some additional memory bugs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0682 to these issues.

OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login sessions and port forwarding, among other functions.

The OpenSSH team has announced a bug which affects the OpenSSH buffer handling code. This bug has the potential of being remotely exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0693 to this issue.

All users of OpenSSH should immediately apply this update which contains a backported fix for this issue.

According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1.  Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH.  Since Nessus solely relied on the banner of the remote SSH server to perform this check, this might be a false positive. 

If you are running a RedHat host, make sure that the command :

  rpm -q openssh-server

returns :

  openssh-server-3.1p1-13 (RedHat 7.x)   openssh-server-3.4p1-7  (RedHat 8.0)   openssh-server-3.5p1-11 (RedHat 9)

ID	Name	Product	Family	Severity
701168	OpenSSH < 3.7.1 Multiple Vulnerabilities	Nessus Network Monitor	SSH	critical
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
15220	Debian DSA-383-2 : ssh-krb5 - possible remote vulnerability	Nessus	Debian Local Security Checks	critical
15219	Debian DSA-382-3 : ssh - possible remote vulnerability	Nessus	Debian Local Security Checks	critical
1994	OpenSSH < 3.7 buffer_append_space Function Overflow	Nessus Network Monitor	SSH	critical
14072	Mandrake Linux Security Advisory : openssh (MDKSA-2003:090-1)	Nessus	Mandriva Local Security Checks	critical
12421	RHEL 2.1 : openssh (RHSA-2003:280)	Nessus	Red Hat Local Security Checks	critical
11837	OpenSSH < 3.7.1 Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2003-0693

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical