The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssh: loading of untrusted PKCS#11 modules in ssh-agent (CVE-2016-10009)

  - openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression     support (CVE-2016-10012)

  - The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages     containing authorized_keys command options, which allows remote authenticated users to obtain potentially     sensitive information by reading these messages, as demonstrated by the shared user account required by     Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell     or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own     home directory. (CVE-2012-0814)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - The auth_parse_options function in auth-options.c in     sshd in OpenSSH before 5.7 provides debug messages     containing authorized_keys command options, which allows     remote authenticated users to obtain potentially     sensitive information by reading these messages, as     demonstrated by the shared user account required by     Gitolite. NOTE: this can cross privilege boundaries     because a user account may intentionally have no shell     or filesystem access, and therefore may have no     supported way to read an authorized_keys file in its own     home directory. (CVE-2012-0814)

The remote host is affected by the vulnerability described in GLSA-201405-06 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, cause a Denial of       Service condition, obtain sensitive information, or bypass environment       restrictions.
  Workaround :

    There is no known workaround at this time.

This collective security update of openssh fixes multiple security issues :

  - memory exhaustion in gssapi due to integer overflow.
    (bnc#756370, CVE-2011-5000)

  - forced command option information leak (bnc#744643,     CVE-2012-0814) Additionally, the following bug has been     fixed :

  - server-side delay upon user exiting a ssh session, due     to DNS queries from libaudit. (bnc#752354)

This collective security update of openssh fixed multiple security issues :

  - memory exhaustion in gssapi due to integer overflow.
    (bnc#756370, CVE-2011-5000)

  - forced command option information leak (bnc#744643,     CVE-2012-0814)

Versions of OpenSSH server before 5.7 may be affected by the following vulnerabilities :

  - A security bypass vulnerability because OpenSSH does not properly validate the public parameters in the J-PAKE protocol.  This could allow an attacker to authenticate without the shared secret.  Note that this issue is only exploitable when OpenSSH is built with J-PAKE support, which is currently experimental and disabled by default. (CVE-2010-4478)

  - The auth_parse options function in auth-options.c in sshd provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages. (CVE-2012-0841)

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner.

According to its banner, the version of OpenSSH running on the remote host is earlier than 5.7.  Versions before 5.7 may be affected by the following vulnerabilities :

  - A security bypass vulnerability because OpenSSH does not     properly validate the public parameters in the J-PAKE     protocol.  This could allow an attacker to authenticate     without the shared secret.  Note that this issue is only     exploitable when OpenSSH is built with J-PAKE support,     which is currently experimental and disabled by default,     and that Nessus has not checked whether J-PAKE support     is indeed enabled. (CVE-2010-4478)

  - The auth_parse_options function in auth-options.c in     sshd provides debug messages containing authorized_keys     command options, which allows remote, authenticated     users to obtain potentially sensitive information by     reading these messages. (CVE-2012-0814)

ID	Name	Product	Family	Severity
198952	RHEL 6 : openssh (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
80775	Oracle Solaris Third-Party Patch Update : ssh (cve_2010_5107_denial_of)	Nessus	Solaris Local Security Checks	medium
73958	GLSA-201405-06 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
64211	SuSE 11.1 Security Update : openssh (SAT Patch Number 6672)	Nessus	SuSE Local Security Checks	low
61695	SuSE 10 Security Update : openssh (ZYPP Patch Number 8248)	Nessus	SuSE Local Security Checks	low
6300	OpenSSH < 5.7 Multiple Vulnerabilities	Nessus Network Monitor	SSH	medium
44081	OpenSSH < 5.7 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2012-0814

high

Tenable Plugins

high

medium

medium

low

low

medium

high