The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

An update of the openssh package has been released.

The version of OpenSSH installed on the remote AIX host is affected by a vulnerability in the process_open function of sftp-server.c in OpenSSH in that it does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

The installed version of OpenSSH is prior to 7.6 and is affected by a vulnerability in the 'process_open' function that does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

According to its self-reported version number, the version of Junos Space running on the remote device is < 18.2R1, and is therefore affected by multiple vulnerabilities:

  - Due to untrusted search path vulnerability in ssh-agent.c in ssh-agent     in OpenSSH before 7.4, unauthenticated, remote attacker can execute execute     arbitrary local PKCS#11 modules by leveraging control over a forwarded     agent-socket. (CVE-2016-10009)    
  - In OpenSSH before 7.4, an authenticated local attacker can escalate     privileges via unspecified vectors, related to serverloop.c.     (CVE-2016-10010)     
  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the     effects of realloc on buffer contents. an authenticated local attacker     can obtain sensitive private-key information by leveraging access to a     privilege-separated child process. (CVE-2016-10011)     
  - In sshd in OpenSSH before 7.4, a local attacker can gain privileges by     leveraging access to a sandboxed privilege-separation process due to a     bounds check that's enforced by all by the shared memory manager.     (CVE-2016-10012)     
  - The process_open function in sftp-server.c in OpenSSH before 7.6 does not     properly prevent write operations in readonly mode, which allows local     attackers to create zero-length files. (CVE-2017-15906)     
  - A reflected cross-site scripting vulnerability in OpenNMS included     with Juniper Networks Junos Space may allow the stealing of sensitive     information or session credentials from Junos Space administrators or     perform administrative actions.  (CVE-2018-0046)

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The process_open function in sftp-server.c in OpenSSH     before 7.6 does not properly prevent write operations     in readonly mode, which allows attackers to create     zero-length files.(CVE-2017-15906)

  - In OpenSSH 7.9, scp.c in the scp client allows remote     SSH servers to bypass intended access restrictions via     the filename of . or an empty filename. The impact is     modifying the permissions of the target directory on     the client side.(CVE-2018-20685)

  - An issue was discovered in OpenSSH 7.9. Due to missing     character encoding in the progress display, a malicious     server (or Man-in-The-Middle attacker) can employ     crafted object names to manipulate the client output,     e.g., by using ANSI control codes to hide additional     files being transferred. This affects     refresh_progress_meter() in     progressmeter.c.(CVE-2019-6109)

  - An issue was discovered in OpenSSH 7.9. Due to the scp     implementation being derived from 1983 rcp, the server     chooses which files/directories are sent to the client.
    However, the scp client only performs cursory     validation of the object name returned (only directory     traversal attacks are prevented). A malicious scp     server (or Man-in-The-Middle attacker) can overwrite     arbitrary files in the scp client target directory. If     recursive operation (-r) is performed, the server can     manipulate subdirectories as well (for example, to     overwrite the .ssh/authorized_keys     file).(CVE-2019-6111)

  - OpenSSH through 7.7 is prone to a user enumeration     vulnerability due to not delaying bailout for an     invalid authenticating user until after the packet     containing the request has been fully parsed, related     to auth2-gss.c, auth2-hostbased.c, and     auth2-pubkey.c.(CVE-2018-15473)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues :

Security issues fixed :

CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability.
(bsc#1106163)

CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files. (bsc#1065000, bsc#1106726)

CVE-2016-10708: sshd allowed remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. (bsc#1076957)

CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)

CVE-2016-10012: Removed pre-auth compression support from the server to prevent possible cryptographic attacks. (bsc#1016370)

Bugs fixed: Fixed failing 'AuthorizedKeysCommand' within a 'Match User' block in sshd_config (bsc#1105180)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh provides the following fixes :

Security issues fixed :

CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server (bsc#1065000).

CVE-2016-10012: Remove pre-auth compression support from the server to prevent possible cryptographic attacks (bsc#1016370).

CVE-2008-1483: Refine handling of sockets for X11 forwarding to remove reintroduced CVE-2008-1483 (bsc#1069509).

CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message (bsc#1076957).

Bug fixes: bsc#1017099: Enable case-insensitive hostname matching.

bsc#1023275: Add a new switch for printing diagnostic messages in sftp client's batch mode.

bsc#1048367: systemd integration to work around various race conditions.

bsc#1053972: Remove duplicate KEX method.

bsc#1092582: Add missing piece of systemd integration.

Remove the limit on the amount of tasks sshd can run.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues: Security issues fixed :

  - CVE-2016-10012: Fix pre-auth compression checks that     could be optimized away (bsc#1016370).

  - CVE-2016-10708: Fix remote denial of service (NULL     pointer dereference and daemon crash) via an     out-of-sequence NEWKEYSmessage (bsc#1076957).

  - CVE-2017-15906: Fix r/o sftp-server zero byte file     creation (bsc#1065000).

  - CVE-2008-1483: Fix accidental re-introduction of     CVE-2008-1483 (bsc#1069509). Bug fixes :

  - bsc#1017099: Match conditions with uppercase hostnames     fail (bsc#1017099)

  - bsc#1053972: supportedKeyExchanges     diffie-hellman-group1-sha1 is duplicated (bsc#1053972)

  - bsc#1023275: Messages suppressed after upgrade from SLES     11 SP3 to SP4 (bsc#1023275)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.(CVE-2017-15906)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The process_open function in sftp-server.c in OpenSSH     before 7.6 does not properly prevent write operations     in readonly mode, which allows attackers to create     zero-length files.(CVE-2017-15906)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Improper write operations in readonly mode allow for zero-length file creation

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.(CVE-2017-15906)

Security Fix(es) :

  - openssh: Improper write operations in readonly mode     allow for zero- length file creation (CVE-2017-15906)

Additional Changes :

An update for openssh is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* openssh: Improper write operations in readonly mode allow for zero-length file creation (CVE-2017-15906)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0980 advisory.

    - Fix for CVE-2017-15906 (#1517226)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0980 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Improper write operations in readonly mode allow for zero-length file creation (CVE-2017-15906)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and 14.2 to fix a security issue.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3538-1 advisory.

    Jann Horn discovered that OpenSSH incorrectly loaded PKCS#11 modules from untrusted directories. A remote     attacker could possibly use this issue to execute arbitrary PKCS#11 modules. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10009)

    Jann Horn discovered that OpenSSH incorrectly handled permissions on Unix-domain sockets when privilege     separation is disabled. A local attacker could possibly use this issue to gain privileges. This issue only     affected Ubuntu 16.04 LTS. (CVE-2016-10010)

    Jann Horn discovered that OpenSSH incorrectly handled certain buffer memory operations. A local attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS     and Ubuntu 16.04 LTS. (CVE-2016-10011)

    Guido Vranken discovered that OpenSSH incorrectly handled certain shared memory manager operations. A     local attacker could possibly use issue to gain privileges. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10012)

    Michal Zalewski discovered that OpenSSH incorrectly prevented write operations in readonly mode. A remote     attacker could possibly use this issue to create zero-length files, leading to a denial of service.
    (CVE-2017-15906)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update provides new upstream release OpenSSH 7.6 with several bug fixes and new features, including CVE-2017-15906, compatibility with WinSCP, improvement for PAM stack, enablement for s390x sandbox, new GSSAPI key exchange methods and improvement of handling kerberos tickets.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201801-05 (OpenSSH: Permission issue)

    The process_open function in sftp-server.c in OpenSSH did not properly       prevent write operations in readonly mode.
  Impact :

    A remote attacker could cause the creation of zero-length files.
  Workaround :

    There is no known workaround at this time.

This update for openssh fixes the following issues :

Security issue fixed :

  - CVE-2017-15906: Stricter checking of operations in     read-only mode in sftp server (bsc#1065000).

Bug fixes :

  - FIPS: Startup selfchecks (bsc#1068310).

  - FIPS: Silent complaints about unsupported key exchange     methods (bsc#1006166).

  - Refine handling of sockets for X11 forwarding to remove     reintroduced CVE-2008-1483 (bsc#1069509).

  - Test configuration before running daemon to prevent     looping resulting in service shutdown (bsc#1048367)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Security fix for CVE-2017-15906: Improper write operations in readonly mode (#1506630)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssh fixes the following issues: Security issue fixed :

  - CVE-2017-15906: Stricter checking of operations in     read-only mode in sftp server (bsc#1065000). Bug fixes :

  - FIPS: Startup selfchecks (bsc#1068310).

  - FIPS: Silent complaints about unsupported key exchange     methods (bsc#1006166).

  - Refine handling of sockets for X11 forwarding to remove     reintroduced CVE-2008-1483 (bsc#1069509).

  - Test configuration before running daemon to prevent     looping resulting in service shutdown (bsc#1048367)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-15906: Improper write operations in readonly mode

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of OpenSSH running on the remote host is prior to 7.6. It is, therefore, affected by a file creation restriction bypass vulnerability related to the 'process_open' function in the file 'sftp-server.c' that allows authenticated users to create zero-length files regardless of configuration.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202796	Photon OS 1.0: Openssh PHSA-2017-0052	Nessus	PhotonOS Local Security Checks	medium
136323	AIX OpenSSH Advisory : openssh_advisory11.asc	Nessus	AIX Local Security Checks	medium
701159	OpenSSH < 7.6 Security Bypass	Nessus Network Monitor	SSH	medium
126510	Juniper Junos Space < 18.2R1 Multiple Vulnerabilities (JSA10880)	Nessus	Junos Local Security Checks	high
124929	EulerOS Virtualization 3.0.1.0 : openssh (EulerOS-SA-2019-1426)	Nessus	Huawei Local Security Checks	medium
121772	Photon OS 2.0: Openssh PHSA-2017-0051	Nessus	PhotonOS Local Security Checks	medium
118498	SUSE SLES11 Security Update : openssh (SUSE-SU-2018:3540-1)	Nessus	SuSE Local Security Checks	high
117452	SUSE SLES12 Security Update : openssh (SUSE-SU-2018:2685-1)	Nessus	SuSE Local Security Checks	high
111639	SUSE SLES11 Security Update : openssh (SUSE-SU-2018:2275-1)	Nessus	SuSE Local Security Checks	high
110781	Amazon Linux 2 : openssh (ALAS-2018-1042)	Nessus	Amazon Linux Local Security Checks	medium
110145	EulerOS 2.0 SP2 : openssh (EulerOS-SA-2018-1141)	Nessus	Huawei Local Security Checks	medium
110144	EulerOS 2.0 SP1 : openssh (EulerOS-SA-2018-1140)	Nessus	Huawei Local Security Checks	medium
109700	Amazon Linux AMI : openssh (ALAS-2018-1018)	Nessus	Amazon Linux Local Security Checks	medium
109454	Scientific Linux Security Update : openssh on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	medium
109378	CentOS 7 : openssh (CESA-2018:0980)	Nessus	CentOS Local Security Checks	medium
109111	Oracle Linux 7 : openssh (ELSA-2018-0980)	Nessus	Oracle Linux Local Security Checks	medium
108992	RHEL 7 : openssh (RHSA-2018:0980)	Nessus	Red Hat Local Security Checks	medium
107233	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openssh (SSA:2018-067-01)	Nessus	Slackware Local Security Checks	medium
106266	Ubuntu 14.04 LTS / 16.04 LTS : OpenSSH vulnerabilities (USN-3538-1)	Nessus	Ubuntu Local Security Checks	high
105931	Fedora 27 : openssh (2017-96d1995b70)	Nessus	Fedora Local Security Checks	medium
105631	GLSA-201801-05 : OpenSSH: Permission issue	Nessus	Gentoo Local Security Checks	medium
105237	openSUSE Security Update : openssh (openSUSE-2017-1351)	Nessus	SuSE Local Security Checks	medium
105202	Fedora 25 : openssh (2017-78f0991378)	Nessus	Fedora Local Security Checks	medium
105093	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2017:3230-1)	Nessus	SuSE Local Security Checks	medium
104824	Fedora 26 : openssh (2017-4862a3bfb1)	Nessus	Fedora Local Security Checks	medium
103781	OpenSSH < 7.6	Nessus	Misc.	medium

Detections

Analytics

CVE-2017-15906

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium