OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.

This update for openssh provides the following fixes :

Security issues fixed :

CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server (bsc#1065000).

CVE-2016-10012: Remove pre-auth compression support from the server to prevent possible cryptographic attacks (bsc#1016370).

CVE-2008-1483: Refine handling of sockets for X11 forwarding to remove reintroduced CVE-2008-1483 (bsc#1069509).

CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message (bsc#1076957).

Bug fixes: bsc#1017099: Enable case-insensitive hostname matching.

bsc#1023275: Add a new switch for printing diagnostic messages in sftp client's batch mode.

bsc#1048367: systemd integration to work around various race conditions.

bsc#1053972: Remove duplicate KEX method.

bsc#1092582: Add missing piece of systemd integration.

Remove the limit on the amount of tasks sshd can run.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues: Security issues fixed :

  - CVE-2016-10012: Fix pre-auth compression checks that     could be optimized away (bsc#1016370).

  - CVE-2016-10708: Fix remote denial of service (NULL     pointer dereference and daemon crash) via an     out-of-sequence NEWKEYSmessage (bsc#1076957).

  - CVE-2017-15906: Fix r/o sftp-server zero byte file     creation (bsc#1065000).

  - CVE-2008-1483: Fix accidental re-introduction of     CVE-2008-1483 (bsc#1069509). Bug fixes :

  - bsc#1017099: Match conditions with uppercase hostnames     fail (bsc#1017099)

  - bsc#1053972: supportedKeyExchanges     diffie-hellman-group1-sha1 is duplicated (bsc#1053972)

  - bsc#1023275: Messages suppressed after upgrade from SLES     11 SP3 to SP4 (bsc#1023275)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

Security issue fixed :

  - CVE-2017-15906: Stricter checking of operations in     read-only mode in sftp server (bsc#1065000).

Bug fixes :

  - FIPS: Startup selfchecks (bsc#1068310).

  - FIPS: Silent complaints about unsupported key exchange     methods (bsc#1006166).

  - Refine handling of sockets for X11 forwarding to remove     reintroduced CVE-2008-1483 (bsc#1069509).

  - Test configuration before running daemon to prevent     looping resulting in service shutdown (bsc#1048367)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for openssh fixes the following issues: Security issue fixed :

  - CVE-2017-15906: Stricter checking of operations in     read-only mode in sftp server (bsc#1065000). Bug fixes :

  - FIPS: Startup selfchecks (bsc#1068310).

  - FIPS: Silent complaints about unsupported key exchange     methods (bsc#1006166).

  - Refine handling of sockets for X11 forwarding to remove     reintroduced CVE-2008-1483 (bsc#1069509).

  - Test configuration before running daemon to prevent     looping resulting in service shutdown (bsc#1048367)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OpenSSH running on the remote host is affected by the following vulnerabilities :

  - OpenSSH 4.3p2, and probably other versions, allows local     users to hijack forwarded X connections by causing ssh     to set DISPLAY to :10, even when another process is     listening on the associated port, as demonstrated by     opening TCP port 6010 (IPv4) and sniffing a cookie sent     by Emacs. (CVE-2008-1483)

  - OpenSSH before 4.9 allows remote authenticated users to     bypass the sshd_config ForceCommand directive by     modifying the .ssh/rc session file. (CVE-2008-1657)

Updated openssh packages that fix a security issue, bugs, and add support for recording login user IDs for audit are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation.

An error in the way OpenSSH handled GSSAPI credential delegation was discovered. OpenSSH as distributed with Red Hat Enterprise Linux 4 contains support for GSSAPI user authentication, typically used for supporting Kerberos. On OpenSSH installations which have GSSAPI enabled, this flaw could allow a user who sucessfully authenticates using a method other than GSSAPI to be delegated with GSSAPI credentials. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2798 to this issue.

Additionally, the following bugs have been addressed :

The ssh command incorrectly failed when it was issued by the root user with a non-default group set.

The sshd daemon could fail to properly close the client connection if multiple X clients were forwarded over the connection and the client session exited.

The sshd daemon could bind only on the IPv6 address family for X forwarding if the port on IPv4 address family was already bound. The X forwarding did not work in such cases.

This update also adds support for recording login user IDs for the auditing service. The user ID is attached to the audit records generated from the user's session.

All users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

A flaw in the X forwarding code of openssh allowed malicious users to steal the X access credentials of other users. (CVE-2008-1483)

OpenSSH allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port.

The updated packages have been patched to prevent this issue.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.5.  Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.5. 

Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-006 applied. 

This update contains security fixes for a number of programs.

The version of Attachmate Reflection for Secure IT UNIX Server installed on the remote host is lower than 7.0 SP1 and thus reportedly affected by several issues : 

  - There is an inherited vulnerability in OpenSSL when parsing malformed ASN.1 structures leading to a denial of service vulnerability (CVE-2006-2937).
  - There is an inherited vulnerability in OpenSSL when parsing parasitic public keys leading to a denial of service vulnerability (CVE-2006-2940).
  - There is an inherited vulnerability in OpenSSL when performing Montgomery multiplication, leading to a side-channel attack vulnerability (CVE-2007-3108).
  - There is an inherited vulnerability in OpenSSH with the execution of the ~/.ssh2/rc session file (CVE-2008-1657).
  - There is an issue with the security of forwarded X11 connections, leading to possible hijacking. (CVE-2008-1483)
  - There are multiple unspecified other vulnerabilities.

The version of Attachmate Reflection for Secure IT UNIX server installed on the remote host is less than 7.0 SP1 and thus reportedly affected by several issues :

  - There is an inherited vulnerability in OpenSSL when     parsing malformed ASN.1 structures leading to a     denial of service vulnerability (CVE-2006-2937).

  - There is an inherited vulnerability in OpenSSL when     parsing parasitic public keys leading to a     denial of service vulnerability (CVE-2006-2940).

  - There is an inherited vulnerability in OpenSSL when     performing Montgomery multiplication, leading to a     side-channel attack vulnerability (CVE-2007-3108).

  - There is an inherited vulnerability in OpenSSH with the     execution of the ~/.ssh2/rc session file     (CVE-2008-1657).

  - There is an issue with the security of forwarded X11     connections, leading to possible hijacking.
    (CVE-2008-1483)

  - There are multiple unspecified other vulnerabilities.
    (CVE-2008-6021)

A flaw in the X forwarding code of openssh allowed malicious users to steal the X access credentials of other users (CVE-2008-1483).

Due to another flaw users could bypass the option 'ForceCommand' (CVE-2008-1657).

A flaw in the X forwarding code of openssh allowed malicious users to steal the X access credentials of other users (CVE-2008-1483).

The remote host is affected by the vulnerability described in GLSA-200804-03 (OpenSSH: Privilege escalation)

    Two issues have been discovered in OpenSSH:
    Timo Juhani     Lindfors discovered that OpenSSH sets the DISPLAY variable in SSH     sessions using X11 forwarding even when it cannot bind the X11 server     to a local port in all address families (CVE-2008-1483).
    OpenSSH will execute the contents of the '.ssh/rc' file even when     the 'ForceCommand' directive is enabled in the global sshd_config     (CVE-2008-1657).
  Impact :

    A local attacker could exploit the first vulnerability to hijack     forwarded X11 sessions of other users and possibly execute code with     their privileges, disclose sensitive data or cause a Denial of Service,     by binding a local X11 server to a port using only one address family.
    The second vulnerability might allow local attackers to bypass intended     security restrictions and execute commands other than those specified     by 'ForceCommand' if they are able to write to their home directory.
  Workaround :

    There is no known workaround at this time.

New openssh packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue.

Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. A local attacker could exploit this flaw on systems with IPv6 enabled to hijack connections, including X11 forwards.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of SSH installed on the remote host is older than 5.0.  Such versions may allow a local user to hijack X11 sessions because it improperly binds TCP ports on the local IPv6 interface if the corresponding ports on the IPv4 interface are in use.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner. 

According to its banner, the version of SSH installed on the remote host is older than 5.0.  Such versions may allow a local user to hijack X11 sessions because it improperly binds TCP ports on the local IPv6 interface if the corresponding ports on the IPv4 interface are in use.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:527 advisory.

    OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation.

    An error in the way OpenSSH handled GSSAPI credential delegation was     discovered. OpenSSH as distributed with Red Hat Enterprise Linux 4 contains     support for GSSAPI user authentication, typically used for supporting     Kerberos. On OpenSSH installations which have GSSAPI enabled, this flaw     could allow a user who sucessfully authenticates using a method other than     GSSAPI to be delegated with GSSAPI credentials. The Common Vulnerabilities     and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2798     to this issue.

    Additionally, the following bugs have been addressed:

    The ssh command incorrectly failed when it was issued by the root user with     a non-default group set.

    The sshd daemon could fail to properly close the client connection if     multiple X clients were forwarded over the connection and the client     session exited.

    The sshd daemon could bind only on the IPv6 address family for X forwarding     if the port on IPv4 address family was already bound. The X forwarding did     not work in such cases.

    This update also adds support for recording login user IDs for the auditing     service. The user ID is attached to the audit records generated from the     user's session.

    All users of openssh should upgrade to these updated packages, which     contain backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
117452	SUSE SLES12 Security Update : openssh (SUSE-SU-2018:2685-1)	Nessus	SuSE Local Security Checks	high
111639	SUSE SLES11 Security Update : openssh (SUSE-SU-2018:2275-1)	Nessus	SuSE Local Security Checks	high
105237	openSUSE Security Update : openssh (openSUSE-2017-1351)	Nessus	SuSE Local Security Checks	medium
105093	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2017:3230-1)	Nessus	SuSE Local Security Checks	medium
73565	AIX OpenSSH Advisory : ssh_advisory.asc	Nessus	AIX Local Security Checks	medium
67028	CentOS 4 : openssh (CESA-2005:527)	Nessus	CentOS Local Security Checks	medium
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
41205	SuSE9 Security Update : OpenSSH (YOU Patch Number 12122)	Nessus	SuSE Local Security Checks	medium
36879	Mandriva Linux Security Advisory : openssh (MDVSA-2008:078)	Nessus	Mandriva Local Security Checks	medium
4682	Mac OS X < 10.5.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
34211	Mac OS X 10.5.x < 10.5.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
34210	Mac OS X Multiple Vulnerabilities (Security Update 2008-006)	Nessus	MacOS X Local Security Checks	critical
4632	Attachmate Reflection for Secure IT UNIX Server < 7.0 SP1 Multiple Vulnerabilities	Nessus Network Monitor	SSH	medium
33948	Attachmate Reflection for Secure IT UNIX server < 7.0 SP1 Multiple Vulnerabilities	Nessus	Misc.	critical
31843	openSUSE 10 Security Update : openssh (openssh-5149)	Nessus	SuSE Local Security Checks	medium
31842	openSUSE 10 Security Update : openssh (openssh-5148)	Nessus	SuSE Local Security Checks	medium
31841	SuSE 10 Security Update : OpenSSH (ZYPP Patch Number 5122)	Nessus	SuSE Local Security Checks	medium
31834	GLSA-200804-03 : OpenSSH: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
31801	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : openssh (SSA:2008-095-01)	Nessus	Slackware Local Security Checks	medium
31784	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : openssh vulnerability (USN-597-1)	Nessus	Ubuntu Local Security Checks	medium
4459	OpenSSH < 5.0 X11 Forwarding Local Session Hijacking	Nessus Network Monitor	SSH	medium
31737	OpenSSH X11 Forwarding Session Hijacking	Nessus	Misc.	medium
19990	RHEL 4 : openssh (RHSA-2005:527)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2008-1483

medium

Tenable Plugins

high

high

medium

medium

medium

medium

critical

medium

medium

critical

critical

critical

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium