The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.

The version of OpenSSH running on the remote host is prior to version 5.9. Such versions are affected by multiple denial of service vulnerabilities:

 - A denial of service vulnerability exists in the gss-serv.c 'ssh_gssapi_parse_ename' function. A remote attacker may be able to trigger this vulnerability if gssapi-with-mic is enabled to create a denial of service condition via a large value in a certain length field. (CVE-2011-5000)
 - On FreeBSD, NetBSD, OpenBSD, and other products, a remote, authenticated attacker could exploit the remote_glob() and process_put() functions to cause a denial of service (CPU and memory consumption). (CVE-2010-4755)

The remote NewStart CGSL host, running version MAIN 4.05, has openssh-latest packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

  - It was discovered that OpenSSH clients did not correctly     verify DNS SSHFP records. A malicious server could use     this flaw to force a connecting client to skip the DNS     SSHFP record check and require the user to perform     manual host verification of the DNS SSHFP record.
    (CVE-2014-2653)

  - It was found that when OpenSSH was used in a Kerberos     environment, remote authenticated users were allowed to     log in as a different user if they were listed in the     ~/.k5users file of that user, potentially bypassing     intended authentication restrictions. (CVE-2014-9278)

  - It was discovered that the OpenSSH sshd daemon did not     check the list of keyboard-interactive authentication     methods for duplicates. A remote attacker could use this     flaw to bypass the MaxAuthTries limit, making it easier     to perform password guessing attacks. (CVE-2015-5600)

  - It was discovered that the OpenSSH sshd daemon fetched     PAM environment settings before running the login     program. In configurations with UseLogin=yes and the     pam_env PAM module configured to read user environment     settings, a local user could use this flaw to execute     arbitrary code as root. (CVE-2015-8325)

  - An information leak flaw was found in the way the     OpenSSH client roaming feature was implemented. A     malicious server could potentially use this flaw to leak     portions of memory (possibly including private SSH keys)     of a successfully authenticated OpenSSH client.
    (CVE-2016-0777)

  - An access flaw was discovered in OpenSSH; the OpenSSH     client did not correctly handle failures to generate     authentication cookies for untrusted X11 forwarding. A     malicious or compromised remote X application could     possibly use this flaw to establish a trusted connection     to the local X server, even if only untrusted X11     forwarding was requested. (CVE-2016-1908)

  - A covert timing channel flaw was found in the way     OpenSSH handled authentication of non-existent users. A     remote unauthenticated attacker could possibly use this     flaw to determine valid user names by measuring the     timing of server responses. (CVE-2016-6210)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssh packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201405-06 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, cause a Denial of       Service condition, obtain sensitive information, or bypass environment       restrictions.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of OpenSSH running on the remote host is prior to version 5.9. Such versions are affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in the     gss-serv.c 'ssh_gssapi_parse_ename' function.  A remote     attacker may be able to trigger this vulnerability if     gssapi-with-mic is enabled to create a denial of service     condition via a large value in a certain length field.
    (CVE-2011-5000)

  - On FreeBSD, NetBSD, OpenBSD, and other products, a     remote, authenticated attacker could exploit the     remote_glob() and process_put() functions to cause a     denial of service (CPU and memory consumption).
    (CVE-2010-4755)

ID	Name	Product	Family	Severity
701162	OpenSSH < 5.9 Multiple DoS	Nessus Network Monitor	SSH	medium
127415	NewStart CGSL MAIN 4.05 : openssh-latest Multiple Vulnerabilities (NS-SA-2019-0146)	Nessus	NewStart CGSL Local Security Checks	critical
127206	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssh Multiple Vulnerabilities (NS-SA-2019-0036)	Nessus	NewStart CGSL Local Security Checks	high
73958	GLSA-201405-06 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
17703	OpenSSH < 5.9 Multiple DoS	Nessus	Denial of Service	medium

Detections

Analytics

CVE-2010-4755

medium

Tenable Plugins

medium

critical

high

medium

medium