The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssh packages installed that are affected by multiple vulnerabilities:

  - scp in OpenSSH 4.2p1 allows attackers to execute     arbitrary commands via filenames that contain shell     metacharacters or spaces, which are expanded twice.
    (CVE-2006-0225)

  - sshd in OpenSSH before 4.4, when using the version 1 SSH     protocol, allows remote attackers to cause a denial of     service (CPU consumption) via an SSH packet that     contains duplicate blocks, which is not properly handled     by the CRC compensation attack detector. (CVE-2006-4924)

  - Signal handler race condition in OpenSSH before 4.4     allows remote attackers to cause a denial of service     (crash), and possibly execute arbitrary code if GSSAPI     authentication is enabled, via unspecified vectors that     lead to a double-free. (CVE-2006-5051)

  - Unspecified vulnerability in the sshd Privilege     Separation Monitor in OpenSSH before 4.5 causes weaker     verification that authentication has been successful,     which might allow attackers to bypass authentication.
    NOTE: as of 20061108, it is believed that this issue is     only exploitable by leveraging vulnerabilities in the     unprivileged process, which are not known to exist.
    (CVE-2006-5794)

  - Unspecified vulnerability in the     linux_audit_record_event function in OpenSSH 4.3p2, as     used on Fedora Core 6 and possibly other systems, allows     remote attackers to write arbitrary characters to an     audit log via a crafted username. NOTE: some of these     details are obtained from third party information.
    (CVE-2007-3102)

  - The (1) remote_glob function in sftp-glob.c and the (2)     process_put function in sftp.c in OpenSSH 5.8 and     earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2,     OpenBSD 4.7, and other products, allow remote     authenticated users to cause a denial of service (CPU     and memory consumption) via crafted glob expressions     that do not match any pathnames, as demonstrated by glob     expressions in SSH_FXP_STAT requests to an sftp daemon,     a different vulnerability than CVE-2010-2632.
    (CVE-2010-4755)

  - The default configuration of OpenSSH through 6.1     enforces a fixed time limit between establishing a TCP     connection and completing a login, which makes it easier     for remote attackers to cause a denial of service     (connection-slot exhaustion) by periodically making many     new TCP connections. (CVE-2010-5107)

  - It was found that OpenSSH did not properly handle     certain AcceptEnv parameter values with wildcard     characters. A remote attacker could use this flaw to     bypass intended environment variable restrictions.
    (CVE-2014-2532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

NewStart CGSL CORE 5.04 / MAIN 5.04 : openssh Multiple Vulnerabilities (NS-SA-2019-0036)

high Nessus Plugin ID 127206

Version 1.7