OpenSSH Kerberos TGT/AFS Token Passing Remote Overflow

high Nessus Plugin ID 10954

Language:

Synopsis

Arbitrary code may be run on the remote host.

Description

You are running a version of OpenSSH older than OpenSSH 3.2.1.

A buffer overflow exists in the daemon if AFS is enabled on your system, or if the options KerberosTgtPassing or AFSTokenPassing are enabled. Even in this scenario, the vulnerability may be avoided by enabling UsePrivilegeSeparation.

Versions prior to 2.9.9 are vulnerable to a remote root exploit. Versions prior to 3.2.1 are vulnerable to a local root exploit.

Solution

Upgrade to version 3.2.1 or later.

Plugin Details

Severity: High

ID: 10954

File Name: openssh_afs.nasl

Version: 1.29

Type: remote

Family: Gain a shell remotely

Published: 5/12/2002

Updated: 3/27/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Required KB Items: installed_sw/OpenSSH

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/22/2003

Reference Information

CVE: CVE-2002-0575

BID: 4560

Detections

Analytics