Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0555 advisory.

    - CVE-2007-3102 - prevent audit log injection through user name (#243204)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0540 advisory.

    - fixed audit log injection problem (CVE-2007-3102) (#248059)
    - fix an information leak in Kerberos password authentication (CVE-2006-5052)       (#234638)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has openssh-latest packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

  - It was discovered that OpenSSH clients did not correctly     verify DNS SSHFP records. A malicious server could use     this flaw to force a connecting client to skip the DNS     SSHFP record check and require the user to perform     manual host verification of the DNS SSHFP record.
    (CVE-2014-2653)

  - It was found that when OpenSSH was used in a Kerberos     environment, remote authenticated users were allowed to     log in as a different user if they were listed in the     ~/.k5users file of that user, potentially bypassing     intended authentication restrictions. (CVE-2014-9278)

  - It was discovered that the OpenSSH sshd daemon did not     check the list of keyboard-interactive authentication     methods for duplicates. A remote attacker could use this     flaw to bypass the MaxAuthTries limit, making it easier     to perform password guessing attacks. (CVE-2015-5600)

  - It was discovered that the OpenSSH sshd daemon fetched     PAM environment settings before running the login     program. In configurations with UseLogin=yes and the     pam_env PAM module configured to read user environment     settings, a local user could use this flaw to execute     arbitrary code as root. (CVE-2015-8325)

  - An information leak flaw was found in the way the     OpenSSH client roaming feature was implemented. A     malicious server could potentially use this flaw to leak     portions of memory (possibly including private SSH keys)     of a successfully authenticated OpenSSH client.
    (CVE-2016-0777)

  - An access flaw was discovered in OpenSSH; the OpenSSH     client did not correctly handle failures to generate     authentication cookies for untrusted X11 forwarding. A     malicious or compromised remote X application could     possibly use this flaw to establish a trusted connection     to the local X server, even if only untrusted X11     forwarding was requested. (CVE-2016-1908)

  - A covert timing channel flaw was found in the way     OpenSSH handled authentication of non-existent users. A     remote unauthenticated attacker could possibly use this     flaw to determine valid user names by measuring the     timing of server responses. (CVE-2016-6210)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssh packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated pam packages that fix two security flaws, resolve two bugs, and add an enhancement are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication.

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716)

A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

As well, these updated packages fix the following bugs :

* the pam_xauth module, which is used for copying the X11 authentication cookie, did not reset the 'XAUTHORITY' variable in certain circumstances, causing unnecessary delays when using su command.

* when calculating password similarity, pam_cracklib disregarded changes to the last character in passwords when 'difok=x' (where 'x' is the number of characters required to change) was configured in '/etc/pam.d/system-auth'. This resulted in password changes that should have been successful to fail with the following error :

BAD PASSWORD: is too similar to the old one

This issue has been resolved in these updated packages.

* the pam_limits module, which provides setting up system resources limits for user sessions, reset the nice priority of the user session to '0' if it was not configured otherwise in the '/etc/security/limits.conf' configuration file.

These updated packages add the following enhancement :

* a new PAM module, pam_tally2, which allows accounts to be locked after a maximum number of failed log in attempts.

All users of PAM should upgrade to these updated packages, which resolve these issues and add this enhancement.

Updated openssh packages that fix two security issues and various bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in OpenSSH server, a remote attacker may have been able to determine if a username is valid. (CVE-2006-5052)

The following bugs were also fixed :

* the ssh daemon did not generate audit messages when an ssh session was closed.

* GSSAPI authentication sometimes failed on clusters using DNS or load-balancing.

* the sftp client and server leaked small amounts of memory in some cases.

* the sftp client didn't properly exit and return non-zero status in batch mode when the destination disk drive was full.

* when restarting the ssh daemon with the initscript, the ssh daemon was sometimes not restarted successfully because the old running ssh daemon was not properly killed.

* with challenge/response authentication enabled, the pam sub-process was not terminated if the user authentication timed out.

All users of openssh should upgrade to these updated packages, which contain patches to correct these issues.

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716)

A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

As well, these updated packages fix the following bugs :

  - the pam_xauth module, which is used for copying the X11     authentication cookie, did not reset the 'XAUTHORITY'     variable in certain circumstances, causing unnecessary     delays when using su command.

  - when calculating password similarity, pam_cracklib     disregarded changes to the last character in passwords     when 'difok=x' (where 'x' is the number of characters     required to change) was configured in     '/etc/pam.d/system-auth'. This resulted in password     changes that should have been successful to fail with     the following error :

BAD PASSWORD: is too similar to the old one

This issue has been resolved in these updated packages.

  - the pam_limits module, which provides setting up system     resources limits for user sessions, reset the nice     priority of the user session to '0' if it was not     configured otherwise in the '/etc/security/limits.conf'     configuration file.

These updated packages add the following enhancement :

  - a new PAM module, pam_tally2, which allows accounts to     be locked after a maximum number of failed log in     attempts.

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in OpenSSH server, a remote attacker may have been able to determine if a username is valid. (CVE-2006-5052)

The following bugs were also fixed :

  - the ssh daemon did not generate audit messages when an     ssh session was closed.

  - GSSAPI authentication sometimes failed on clusters using     DNS or load-balancing.

  - the sftp client and server leaked small amounts of     memory in some cases.

  - the sftp client didn't properly exit and return non-zero     status in batch mode when the destination disk drive was     full.

  - when restarting the ssh daemon with the initscript, the     ssh daemon was sometimes not restarted successfully     because the old running ssh daemon was not properly     killed.

  - with challenge/response authentication enabled, the pam     sub-process was not terminated if the user     authentication timed out.

Problem description :

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716)

A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

As well, these updated packages fix the following bugs :

  - truncated MD5-hashed passwords in '/etc/shadow' were     treated as valid, resulting in insecure and invalid     passwords.

  - the pam_namespace module did not convert context names     to raw format and did not unmount polyinstantiated     directories in some cases. It also crashed when an     unknown user name was used in     '/etc/security/namespace.conf', the pam_namespace     configuration file.

  - the pam_selinux module was not relabeling the     controlling tty correctly, and in some cases it did not     send complete information about user role and level     change to the audit subsystem.

These updated packages add the following enhancements :

  - pam_limits module now supports parsing additional config     files placed into the /etc/security/limits.d/ directory.
    These files are read after the main configuration file.

  - the modules pam_limits, pam_access, and pam_time now     send a message to the audit subsystem when a user is     denied access based on the number of login sessions,     origin of user, and time of login.

  - pam_unix module security properties were improved.
    Functionality in the setuid helper binary, unix_chkpwd,     which was not required for user authentication, was     moved to a new non-setuid helper binary, unix_update.

Problem description :

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in the OpenSSH server, a remote attacker was potentially able to determine if a username is valid. (CVE-2006-5052)

The following bugs in SELinux MLS (Multi-Level Security) support has also been fixed in this update :

  - It was sometimes not possible to select a SELinux role     and level when logging in using ssh.

  - If the user obtained a non-default SELinux role or     level, the role change was not recorded in the audit     subsystem.

  - In some cases, on labeled networks, sshd allowed logins     from level ranges it should not allow.

The updated packages also contain experimental support for using private keys stored in PKCS#11 tokens for client authentication. The support is provided through the NSS (Network Security Services) library.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication.

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716)

A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

As well, these updated packages fix the following bugs :

* truncated MD5-hashed passwords in '/etc/shadow' were treated as valid, resulting in insecure and invalid passwords.

* the pam_namespace module did not convert context names to raw format and did not unmount polyinstantiated directories in some cases. It also crashed when an unknown user name was used in '/etc/security/namespace.conf', the pam_namespace configuration file.

* the pam_selinux module was not relabeling the controlling tty correctly, and in some cases it did not send complete information about user role and level change to the audit subsystem.

These updated packages add the following enhancements :

* pam_limits module now supports parsing additional config files placed into the /etc/security/limits.d/ directory. These files are read after the main configuration file.

* the modules pam_limits, pam_access, and pam_time now send a message to the audit subsystem when a user is denied access based on the number of login sessions, origin of user, and time of login.

* pam_unix module security properties were improved. Functionality in the setuid helper binary, unix_chkpwd, which was not required for user authentication, was moved to a new non-setuid helper binary, unix_update.

All users of PAM should upgrade to these updated packages, which resolve these issues and add these enhancements.

Updated openssh packages that fix a security issue and various bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)

A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in the OpenSSH server, a remote attacker was potentially able to determine if a username is valid. (CVE-2006-5052)

The following bugs in SELinux MLS (Multi-Level Security) support has also been fixed in this update :

* It was sometimes not possible to select a SELinux role and level when logging in using ssh.

* If the user obtained a non-default SELinux role or level, the role change was not recorded in the audit subsystem.

* In some cases, on labeled networks, sshd allowed logins from level ranges it should not allow.

The updated packages also contain experimental support for using private keys stored in PKCS#11 tokens for client authentication. The support is provided through the NSS (Network Security Services) library.

All users of openssh should upgrade to these updated packages, which contain patches to correct these issues.

- Tue Oct 2 2007 Tomas Mraz <tmraz at redhat.com> -     4.3p2-25

    - do not fall back on trusted X11 cookies       (CVE-2007-4752) (#280471)

    - Fri Jul 13 2007 Tomas Mraz <tmraz at redhat.com> -       4.3p2-24

    - fixed audit log injection problem (CVE-2007-3102)       (#248059)

    - Thu Jun 21 2007 Tomas Mraz <tmraz at redhat.com> -       4.3p2-23

    - document where the nss certificate and token dbs are       looked for

    - Wed Jun 20 2007 Tomas Mraz <tmraz at redhat.com> -       4.3p2-22

    - experimental support for PKCS#11 tokens through       libnss3 (#183423)

    - Tue Apr 3 2007 Tomas Mraz <tmraz at redhat.com> -       4.3p2-21

    - correctly setup context when empty level requested       (#234951)

    - and always request default level as returned by       getseuserbyname (#231695)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenSSH running on the remote host is prior to version 4.4. Such versions are affected by multiple vulnerabilities:

 - A race condition exists that may allow an unauthenticated, remote attacker to crash the service or, on portable OpenSSH, possibly execute code on the affected host. Note that successful exploitation requires that GSSAPI authentication be enabled.
 - A flaw exists that may allow an attacker to determine the validity of usernames on some platforms. Note that this issue requires that GSSAPI authentication be enabled.
 - When SSH version 1 is used, an issue can be triggered via an SSH packet that contains duplicate blocks that could result in a loss of availability for the service.
 - On Fedora Core 6 (and possibly other systems), an unspecified vulnerability in the linux_audit_record_event() function allows remote attackers to inject incorrect information into audit logs.

According to its banner, the version of OpenSSH installed on the remote host is affected by multiple vulnerabilities :

  - A race condition exists that may allow an     unauthenticated, remote attacker to crash the service     or, on portable OpenSSH, possibly execute code on the     affected host.  Note that successful exploitation     requires that GSSAPI authentication be enabled.
    
  - A flaw exists that may allow an attacker to determine     the validity of usernames on some platforms. Note that     this issue requires that GSSAPI authentication be     enabled.

  - When SSH version 1 is used, an issue can be triggered     via an SSH packet that contains duplicate blocks that     could result in a loss of availability for the service.

  - On Fedora Core 6 (and possibly other systems), an     unspecified vulnerability in the     linux_audit_record_event() function allows remote     attackers to inject incorrect information into     audit logs.

ID	Name	Product	Family	Severity
180622	Oracle Linux 5 : pam (ELSA-2007-0555)	Nessus	Oracle Linux Local Security Checks	critical
180606	Oracle Linux 5 : openssh (ELSA-2007-0540)	Nessus	Oracle Linux Local Security Checks	critical
127415	NewStart CGSL MAIN 4.05 : openssh-latest Multiple Vulnerabilities (NS-SA-2019-0146)	Nessus	NewStart CGSL Local Security Checks	critical
127206	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssh Multiple Vulnerabilities (NS-SA-2019-0036)	Nessus	NewStart CGSL Local Security Checks	high
67055	CentOS 4 : pam (CESA-2007:0737)	Nessus	CentOS Local Security Checks	medium
67053	CentOS 4 : openssh (CESA-2007:0703)	Nessus	CentOS Local Security Checks	medium
60308	Scientific Linux Security Update : pam on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60306	Scientific Linux Security Update : openssh on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60297	Scientific Linux Security Update : pam on SL5.x	Nessus	Scientific Linux Local Security Checks	medium
60296	Scientific Linux Security Update : openssh on SL5.x	Nessus	Scientific Linux Local Security Checks	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
28239	RHEL 4 : pam (RHSA-2007:0737)	Nessus	Red Hat Local Security Checks	medium
28237	RHEL 4 : openssh (RHSA-2007:0703)	Nessus	Red Hat Local Security Checks	medium
27831	RHEL 5 : pam (RHSA-2007:0555)	Nessus	Red Hat Local Security Checks	medium
27829	RHEL 5 : openssh (RHSA-2007:0540)	Nessus	Red Hat Local Security Checks	medium
27058	Fedora Core 6 : openssh-4.3p2-25.fc6 (2007-715)	Nessus	Fedora Local Security Checks	high
3751	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus Network Monitor	SSH	low
22466	OpenSSH < 4.4 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2007-3102

critical

Tenable Plugins

critical

critical

critical

high

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

high

low

high