The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices (CVE-2015-5600)

  - openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression     support (CVE-2016-10012)

  - The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic     authentication is enabled, allows remote authenticated users to cause a denial of service (memory     consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which     this issue is relevant. (CVE-2011-5000)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices (CVE-2015-5600)

  - openssh: possible fallback from untrusted to trusted X11 forwarding (CVE-2016-1908)

  - The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many new TCP connections. (CVE-2010-5107)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of OpenSSH running on the remote host is prior to version 5.9. Such versions are affected by multiple denial of service vulnerabilities:

 - A denial of service vulnerability exists in the gss-serv.c 'ssh_gssapi_parse_ename' function. A remote attacker may be able to trigger this vulnerability if gssapi-with-mic is enabled to create a denial of service condition via a large value in a certain length field. (CVE-2011-5000)
 - On FreeBSD, NetBSD, OpenBSD, and other products, a remote, authenticated attacker could exploit the remote_glob() and process_put() functions to cause a denial of service (CPU and memory consumption). (CVE-2010-4755)

The remote host is affected by the vulnerability described in GLSA-201405-06 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, cause a Denial of       Service condition, obtain sensitive information, or bypass environment       restrictions.
  Workaround :

    There is no known workaround at this time.

A denial of service flaw was found in the OpenSSH GSSAPI authentication implementation. A remote, authenticated user could use this flaw to make the OpenSSH server daemon (sshd) use an excessive amount of memory, leading to a denial of service. GSSAPI authentication is enabled by default ('GSSAPIAuthentication yes' in '/etc/ssh/sshd_config'). (CVE-2011-5000)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0884 advisory.

    [5.3p1-81]
    - fixes in openssh-5.3p1-required-authentications.patch (#657378)

    [5.3p1-79]
    - fix forward on non-localhost ports with IPv6 (#732955)

    [5.3p1-78]
    - clear SELinux exec context before exec passwd (#814691)

    [5.3p1-77]
    - prevent post-auth resource exhaustion (#809938)

    [5.3p1-76]
    - don't escape backslah in a banner (#809619)

    [5.3p1-75]
    - fix various issues in openssh-5.3p1-required-authentications.patch (#805901)

    [5.3p1-74]
    - fix out-of-memory killer patch (#744236)

    [5.3p1-73]
    - remove openssh-4.3p2-no-v6only.patch (#732955)
    - adjust Linux out-of-memory killer (#744236)
    - fix sshd init script - check existence of crypto (#797384)
    - add RequiredAuthentications[12] (#657378)
    - run privsep slave process as the users SELinux context (#798241)

    [5.3p1-72]
    - drop CAVS test driver (#782091)

    [5.3p1-71]
    - enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI (#756929)
    - add CAVS test driver for the aes-ctr ciphers (#782091)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This collective security update of openssh fixes multiple security issues :

  - memory exhaustion in gssapi due to integer overflow.
    (bnc#756370, CVE-2011-5000)

  - forced command option information leak (bnc#744643,     CVE-2012-0814) Additionally, the following bug has been     fixed :

  - server-side delay upon user exiting a ssh session, due     to DNS queries from libaudit. (bnc#752354)

This collective security update of openssh fixed multiple security issues :

  - memory exhaustion in gssapi due to integer overflow.
    (bnc#756370, CVE-2011-5000)

  - forced command option information leak (bnc#744643,     CVE-2012-0814)

OpenSSH is OpenBSD's Secure Shell (SSH) protocol implementation. These packages include the core files necessary for the OpenSSH client and server.

A denial of service flaw was found in the OpenSSH GSSAPI authentication implementation. A remote, authenticated user could use this flaw to make the OpenSSH server daemon (sshd) use an excessive amount of memory, leading to a denial of service. GSSAPI authentication is enabled by default ('GSSAPIAuthentication yes' in '/etc/ssh/sshd_config'). (CVE-2011-5000)

These updated openssh packages also provide fixes for the following bugs :

  - SSH X11 forwarding failed if IPv6 was enabled and the     parameter X11UseLocalhost was set to 'no'. Consequently,     users could not set X forwarding. This update fixes sshd     and ssh to correctly bind the port for the IPv6     protocol. As a result, X11 forwarding now works as     expected with IPv6.

  - The sshd daemon was killed by the OOM killer when     running a stress test. Consequently, a user could not     log in. With this update, the sshd daemon sets its     oom_adj value to -17. As a result, sshd is not chosen by     OOM killer and users are able to log in to solve     problems with memory.

  - If the SSH server is configured with a banner that     contains a backslash character, then the client will     escape it with another '\' character, so it prints     double backslashes. An upstream patch has been applied     to correct the problem and the SSH banner is now     correctly displayed.

In addition, these updated openssh packages provide the following enhancements :

  - Previously, SSH allowed multiple ways of authentication     of which only one was required for a successful login.
    SSH can now be set up to require multiple ways of     authentication. For example, logging in to an     SSH-enabled machine requires both a passphrase and a     public key to be entered. The RequiredAuthentications1     and RequiredAuthentications2 options can be configured     in the /etc/ssh/sshd_config file to specify     authentications that are required for a successful     login. For example, to set key and password     authentication for SSH version 2, type :

echo 'RequiredAuthentications2 publickey,password' >> /etc/ssh/sshd_config

For more information on the aforementioned /etc/ssh/sshd_config options, refer to the sshd_config man page.

  - Previously, OpenSSH could use the Advanced Encryption     Standard New Instructions (AES-NI) instruction set only     with the AES Cipher-block chaining (CBC) cipher. This     update adds support for Counter (CTR) mode encryption in     OpenSSH so the AES-NI instruction set can now be used     efficiently also with the AES CTR cipher.

  - Prior to this update, an unprivileged slave sshd process     was run as the sshd_t context during privilege     separation (privsep). sshd_t is the SELinux context used     for running the sshd daemon. Given that the unprivileged     slave process is run under the user's UID, it is fitting     to run this process under the user's SELinux context     instead of the privileged sshd_t context. With this     update, the unprivileged slave process is now run as the     user's context instead of the sshd_t context in     accordance with the principle of privilege separation.
    The unprivileged process, which might be potentially     more sensitive to security threats, is now run under the     user's SELinux context.

Users are advised to upgrade to these updated openssh packages, which contain backported patches to resolve these issues and add these enhancements. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

Updated openssh packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenSSH is OpenBSD's Secure Shell (SSH) protocol implementation. These packages include the core files necessary for the OpenSSH client and server.

A denial of service flaw was found in the OpenSSH GSSAPI authentication implementation. A remote, authenticated user could use this flaw to make the OpenSSH server daemon (sshd) use an excessive amount of memory, leading to a denial of service. GSSAPI authentication is enabled by default ('GSSAPIAuthentication yes' in '/etc/ssh/sshd_config'). (CVE-2011-5000)

These updated openssh packages also provide fixes for the following bugs :

* SSH X11 forwarding failed if IPv6 was enabled and the parameter X11UseLocalhost was set to 'no'. Consequently, users could not set X forwarding. This update fixes sshd and ssh to correctly bind the port for the IPv6 protocol. As a result, X11 forwarding now works as expected with IPv6. (BZ#732955)

* The sshd daemon was killed by the OOM killer when running a stress test. Consequently, a user could not log in. With this update, the sshd daemon sets its oom_adj value to -17. As a result, sshd is not chosen by OOM killer and users are able to log in to solve problems with memory. (BZ#744236)

* If the SSH server is configured with a banner that contains a backslash character, then the client will escape it with another '\' character, so it prints double backslashes. An upstream patch has been applied to correct the problem and the SSH banner is now correctly displayed. (BZ#809619)

In addition, these updated openssh packages provide the following enhancements :

* Previously, SSH allowed multiple ways of authentication of which only one was required for a successful login. SSH can now be set up to require multiple ways of authentication. For example, logging in to an SSH-enabled machine requires both a passphrase and a public key to be entered. The RequiredAuthentications1 and RequiredAuthentications2 options can be configured in the /etc/ssh/sshd_config file to specify authentications that are required for a successful login. For example, to set key and password authentication for SSH version 2, type :

echo 'RequiredAuthentications2 publickey,password' >> /etc/ssh/sshd_config

For more information on the aforementioned /etc/ssh/sshd_config options, refer to the sshd_config man page. (BZ#657378)

* Previously, OpenSSH could use the Advanced Encryption Standard New Instructions (AES-NI) instruction set only with the AES Cipher-block chaining (CBC) cipher. This update adds support for Counter (CTR) mode encryption in OpenSSH so the AES-NI instruction set can now be used efficiently also with the AES CTR cipher. (BZ#756929)

* Prior to this update, an unprivileged slave sshd process was run as the sshd_t context during privilege separation (privsep). sshd_t is the SELinux context used for running the sshd daemon. Given that the unprivileged slave process is run under the user's UID, it is fitting to run this process under the user's SELinux context instead of the privileged sshd_t context. With this update, the unprivileged slave process is now run as the user's context instead of the sshd_t context in accordance with the principle of privilege separation. The unprivileged process, which might be potentially more sensitive to security threats, is now run under the user's SELinux context.
(BZ#798241)

Users are advised to upgrade to these updated openssh packages, which contain backported patches to resolve these issues and add these enhancements. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0884 advisory.

  - openssh: post-authentication resource exhaustion bug via GSSAPI (CVE-2011-5000)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of OpenSSH running on the remote host is prior to version 5.9. Such versions are affected by multiple denial of service vulnerabilities :

  - A denial of service vulnerability exists in the     gss-serv.c 'ssh_gssapi_parse_ename' function.  A remote     attacker may be able to trigger this vulnerability if     gssapi-with-mic is enabled to create a denial of service     condition via a large value in a certain length field.
    (CVE-2011-5000)

  - On FreeBSD, NetBSD, OpenBSD, and other products, a     remote, authenticated attacker could exploit the     remote_glob() and process_put() functions to cause a     denial of service (CPU and memory consumption).
    (CVE-2010-4755)

ID	Name	Product	Family	Severity
198967	RHEL 4 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198928	RHEL 5 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
701162	OpenSSH < 5.9 Multiple DoS	Nessus Network Monitor	SSH	medium
73958	GLSA-201405-06 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69706	Amazon Linux AMI : openssh (ALAS-2012-99)	Nessus	Amazon Linux Local Security Checks	low
68558	Oracle Linux 6 : openssh (ELSA-2012-0884)	Nessus	Oracle Linux Local Security Checks	high
64211	SuSE 11.1 Security Update : openssh (SAT Patch Number 6672)	Nessus	SuSE Local Security Checks	low
61695	SuSE 10 Security Update : openssh (ZYPP Patch Number 8248)	Nessus	SuSE Local Security Checks	low
61345	Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
59929	CentOS 6 : openssh (CESA-2012:0884)	Nessus	CentOS Local Security Checks	low
59594	RHEL 6 : openssh (RHSA-2012:0884)	Nessus	Red Hat Local Security Checks	high
17703	OpenSSH < 5.9 Multiple DoS	Nessus	Denial of Service	medium

Detections

Analytics

CVE-2011-5000

high

Tenable Plugins

high

critical

medium

medium

low

high

low

low

low

low

high

medium