The remote host is affected by the vulnerability described in GLSA-201601-01 (OpenSSH: Multiple vulnerabilities)

    Qualys have reported two issues in the &ldquo;roaming&rdquo; code included in       the OpenSSH client, which provides undocumented, experimental support for       resuming SSH connections. An OpenSSH client could be tricked into leaking       parts of its memory to a malicious server. Furthermore, a buffer overflow       can be exploited by a malicious server, but its exploitation requires       non-default options and is mitigated due to another bug.
  Impact :

    A remote attacker could entice a user to connect to a specially crafted       OpenSSH server, possibly resulting in the disclosure of the user&rsquo;s       private keys. Users with private keys that are not protected by a       passphrase are advised to generate new keys if they have connected to an       SSH server they don&rsquo;t fully trust.
    Note that no special configuration is required to be vulnerable as the       roaming feature is enabled by default on the client.
  Workaround :

    The issues can be worked around by disabling the roaming code. To do so,       add &ldquo;UseRoaming no&rdquo; to the SSH client configuration, or specify &ldquo;-o       &lsquo;UseRoaming no&rsquo;&rdquo; on the command line.

Updated openssh packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server.

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory (possibly including private SSH keys) of a successfully authenticated OpenSSH client.
(CVE-2016-0777)

A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options.
(CVE-2016-0778)

Red Hat would like to thank Qualys for reporting these issues.

All openssh users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

This update for openssh fixes the following issues :

  - CVE-2016-0777: A malicious or compromised server could     cause the OpenSSH client to expose part or all of the     client's private key through the roaming feature     (bsc#961642)

  - CVE-2016-0778: A malicious or compromised server could     could trigger a buffer overflow in the OpenSSH client     through the roaming feature (bsc#961645)

This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An information leak flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to leak portions of memory (possibly including private SSH keys) of a successfully authenticated OpenSSH client.
(CVE-2016-0777)

A buffer overflow flaw was found in the way the OpenSSH client roaming feature was implemented. A malicious server could potentially use this flaw to execute arbitrary code on a successfully authenticated OpenSSH client if that client used certain non-default configuration options.
(CVE-2016-0778)

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
87985	GLSA-201601-01 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/1/19	2021/1/11	high
87937	RHEL 7 : openssh (RHSA-2016:0043)	Nessus	Red Hat Local Security Checks	2016/1/15	2019/10/24	high
87962	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0119-1)	Nessus	SuSE Local Security Checks	2016/1/18	2021/1/6	high
87938	Scientific Linux Security Update : openssh on SL7.x x86_64 (20160114)	Nessus	Scientific Linux Local Security Checks	2016/1/15	2021/1/14	high
87963	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0120-1)	Nessus	SuSE Local Security Checks	2016/1/18	2021/1/6	high

检测

插件搜索

high

high

high

high

high