| Nessus Plugin ID: 23683 | Name: RHSA-2006-0738: openssh |
| CVE References: CVE-2006-5794 (cve.mitre.org, nvd.nist.gov) |
| SANS/FBI TOP20 Reference: |
| Group/Family: Red Hat Local Security Checks |
| Risk: High |
Description: Synopsis :
The remote host is missing the patch for the advisory RHSA-2006-0738
Description :
Updated openssh packages that fix an authentication flaw are now available
for Red Hat Enterprise Linux 3 and 4.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.
An authentication flaw was found in OpenSSH's privilege separation monitor.
If it ever becomes possible to alter the behavior of the unprivileged
process when OpenSSH is using privilege separation, an attacker may then be
able to login without possessing proper credentials. (CVE-2006-5794)
Please note that this flaw by itself poses no direct threat to OpenSSH
users. Without another security flaw that could allow an attacker to alter
the behavior of OpenSSH's unprivileged process, this flaw cannot be
exploited. There are currently no known flaws to exploit this behavior.
However, we have decided to issue this erratum to fix this flaw to reduce
the security impact if an unprivileged process flaw is ever found.
Users of openssh should upgrade to these updated packages, which contain a
backported patch to resolve this issue.
See also :
http://rhn.redhat.com/errata/RHSA-2006-0738.html
Solution :
Get the newest RedHat Updates.
/ CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
| Created: 2010-01-17 21:03:32 | Last Changed: 2010-01-17 21:03:32 |