Detections
Analytics
EulerOS 2.0 SP3 : openssh (EulerOS-SA-2020-1419)
medium Nessus Plugin ID 135548
Synopsis
The remote EulerOS host is missing multiple security updates.Description
According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :- Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability.'(CVE-2018-15919)
- An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.(CVE-2019-6109)
- An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client.
However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).(CVE-2019-6111)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected openssh packages.See Also
Plugin Details
Severity: Medium
ID: 135548
File Name: EulerOS_SA-2020-1419.nasl
Version: 1.8
Type: local
Family: Huawei Local Security Checks
Published: 4/15/2020
Updated: 5/13/2022
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.1
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.5
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P
CVSS Score Source: CVE-2019-6111
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2019-6109
Vulnerability Information
CPE: p-cpe:/a:huawei:euleros:openssh-askpass, p-cpe:/a:huawei:euleros:openssh-keycat, p-cpe:/a:huawei:euleros:openssh, p-cpe:/a:huawei:euleros:openssh-clients, p-cpe:/a:huawei:euleros:openssh-server, cpe:/o:huawei:euleros:2.0
Required KB Items: Host/local_checks_enabled, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp
Excluded KB Items: Host/EulerOS/uvp_version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/16/2020