|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Mandrake Local Security Checks >> MDKSA-2002:040-1: openssh Vulnerability Assessment Details
|
MDKSA-2002:040-1: openssh |
||
Check for the version of the openssh package Detailed Explanation for this Vulnerability Assessment The remote host is missing the patch for the advisory MDKSA-2002:040-1 (openssh). An input validation error exists in the OpenSSH server between versions 2.3.1 and 3.3 that can result in an integer overflow and privilege escalation. This error is found in the PAMAuthenticationViaKbdInt code in versions 2.3.1 to 3.3, and the ChallengeResponseAuthentication code in versions 2.9.9 to 3.3. OpenSSH 3.4 and later are not affected, and OpenSSH 3.2 and later prevent privilege escalation if UsePrivilegeSeparation is enabled in OpenSSH 3.3 and higher this is the default behaviour of OpenSSH. To protect yourself, users should be using OpenSSH 3.3 with UsePrivilegeSeparation enabled (see MDKSA:2002-040). However, it is highly recommended that all Mandrake Linux users upgrade to version 3.4 which corrects these errors. There are a few caveats with this upgrade, however, that users should be aware of: - On Linux kernel 2.2 (the default for Mandrake Linux 7.x), the use of Compression and UsePrivilegeSeparation are mutually exclusive. You can use one feature or the other, not both we recommend disabling Compression and using privsep until this can be resolved. - Using privsep may cause some PAM modules which expect to run with root privilege to fail. For instance, users will not be able to change their password if they attempt to log into an account with an expired password. If you absolutely must use one of these features that conflict with privsep, you can disable it in /etc/ssh/sshd_config by using: UsePrivilegeSeparation no However, if you do this, be sure you are running OpenSSH 3.4. Updates to OpenSSH will be made available once these problems are resolved. Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2002:040-1 Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security |
||
Cables, Connectors |
Western Digital 1TB Caviar WD1002FBYS Enterprise SATA Hard Disk Drives
$24.99
Apple MacBook Pro 13” Dual Core i5 16GB RAM | 1TB HD | MacOs Catalina | WARRANTY
$219.00
WD_BLACK 1TB 2.5-inch Performance Hard Drive - WD10SPSX
$69.99
Western Digital 1TB WD Blue PC Desktop 3.5'' Internal CMR Hard Drive - WD10EARZ
$44.99
Seagate ST1000LM035 Mobile HDD 1TB 2.5" SATA III Laptop Hard Drive 0 Relocated
$15.05
Patriot P210 128GB 256GB 512GB 1TB 2TB 2.5" SATA 3 6GB/s Internal SSD PC/MAC Lot
$19.99
Samsung - Geek Squad Certified Refurbished 870 EVO 1TB SATA Solid State Drive
$67.99
1TB Samsung 850 Pro Series 2.5" SATA 3 SSD MZ-7KE1T0BW HDD hard drive MZ-7KE1T0
$59.99
2 PACK Seagate ST1000LM035 Mobile HDD 1TB 2.5" SATA III Laptop Hard Drive
$29.15
Toshiba DT01ABA100V 3.5" SATA Internal Hard Drive 1TB Tested/Wiped
$15.00
|
||
No Discussions have been posted on this vulnerability. |