Detections
Analytics
OpenSSH 7.x < 7.3 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 9507
Synopsis
The remote SSH server may be affected by multiple vulnerabilities.Description
The current version of OpenSSH is 7.x prior to 7.3 and is affected by the following vulnerabilities :- A flaw in the 'do_setup_env()' function in 'session.c' is triggered when handling user-supplied environmental variables. This may potentially allow a local attacker to gain elevated privileges.
- A flaw exists due to the program returning shorter response times for authentication requests with overly long passwords for invalid users than for valid users. This may allow a remote attacker to conduct a timing attack and enumerate valid usernames.
- A flaw in the 'crypt(3)' function via 'sshd(8)' is triggered during the handling of overly long passwords. This may allow a remote attacker to consume excessive CPU resources.
- An unspecified flaw in the 'CBC' padding oracle countermeasures in 'ssh(1)' and 'sshd(8)', which may allow an attacker to conduct a timing attack. No further details have been provided.
- A flaw in 'ssh(1)' and 'sshd(8)' is due to improper operation ordering of MAC verification for Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the MAC before decrypting any ciphertext. This may allow a remote attacker to use a timing attack to gain unauthorized access to potentially sensitive information.
- A flaw exists in the 'crypt(3)' function, accessed via 'sshd(8)', that is triggered during the handling of overly long passwords. This may allow a remote attacker to affect the consumption of CPU resources.
- An unspecified timing flaw exists in the CBC padding oracle countermeasures in the 'ssh(1)' and 'sshd(8)' functions. This may allow a remote attacker to gain access to potentially sensitive information.
Solution
Upgrade to OpenSSH 7.x version 7.3 or later.See Also
Plugin Details
Severity: High
ID: 9507
Family: SSH
Published: 8/12/2016
Updated: 3/6/2019
Nessus ID: 92760, 92641, 92526, 92476
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:openbsd:openssh
Patch Publication Date: 8/1/2016
Vulnerability Publication Date: 8/1/2016