The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0741 advisory.

    - CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317817)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for openssh is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.

Security Fix(es) :

* It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2015-5352)

* A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. (CVE-2015-6563)

* A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. (CVE-2015-6564)

* An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. (CVE-2016-1908)

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users.

It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks.

A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges.

The remote host is affected by the vulnerability described in GLSA-201512-04 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

  Workaround :

    There is no known workaround at this time.

A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. (CVE-2015-6563)

A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. (CVE-2015-6564)

It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks. (CVE-2015-5600)

It was found that the OpenSSH ssh-agent, a program to hold private keys used for public key authentication, was vulnerable to password guessing attacks. An attacker able to connect to the agent could use this flaw to conduct a brute-force attack to unlock keys in the ssh-agent.

This update fixes the following bugs :

  - Previously, the sshd_config(5) man page was misleading     and could thus confuse the user. This update improves     the man page text to clearly describe the AllowGroups     feature.

  - The limit for the function for restricting the number of     files listed using the wildcard character (*) that     prevents the Denial of Service (DoS) for both server and     client was previously set too low. Consequently, the     user reaching the limit was prevented from listing a     directory with a large number of files over Secure File     Transfer Protocol (SFTP). This update increases the     aforementioned limit, thus fixing this bug.

  - When the ForceCommand option with a pseudoterminal was     used and the MaxSession option was set to '2',     multiplexed SSH connections did not work as expected.
    After the user attempted to open a second multiplexed     connection, the attempt failed if the first connection     was still open. This update modifies OpenSSH to issue     only one audit message per session, and the user is thus     able to open two multiplexed connections in this     situation.

  - The ssh-copy-id utility failed if the account on the     remote server did not use an sh-like shell. Remote     commands have been modified to run in an sh-like shell,     and ssh-copy-id now works also with non-sh-like shells.

  - Due to a race condition between auditing messages and     answers when using ControlMaster multiplexing, one     session in the shared connection randomly and     unexpectedly exited the connection. This update fixes     the race condition in the auditing code, and     multiplexing connections now work as expected even with     a number of sessions created at once.

In addition, this update adds the following enhancements :

  - As not all Lightweight Directory Access Protocol (LDAP)     servers possess a default schema, as expected by the     ssh-ldap-helper program, this update provides the user     with an ability to adjust the LDAP query to get public     keys from servers with a different schema, while the     default functionality stays untouched.

  - With this enhancement update, the administrator is able     to set permissions for files uploaded using Secure File     Transfer Protocol (SFTP).

  - This update provides the LDAP schema in LDAP Data     Interchange Format (LDIF) format as a complement to the     old schema previously accepted by OpenLDAP.

  - With this update, the user can selectively disable the     Generic Security Services API (GSSAPI) key exchange     algorithms as any normal key exchange.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91148	Oracle Linux 6 : openssh (ELSA-2016-0741)	Nessus	Oracle Linux Local Security Checks	2016/5/16	2024/10/22	critical
91166	CentOS 6 : openssh (CESA-2016:0741)	Nessus	CentOS Local Security Checks	2016/5/17	2021/1/4	critical
87351	Amazon Linux AMI : openssh (ALAS-2015-625)	Nessus	Amazon Linux Local Security Checks	2015/12/15	2018/4/18	high
87545	GLSA-201512-04 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/12/22	2021/1/11	high
87567	Scientific Linux Security Update : openssh on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	high

检测

插件搜索

critical

critical

high

high

high