|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Mandrake Local Security Checks >> MDKSA-2002:040-1: openssh Vulnerability Assessment Details
|
MDKSA-2002:040-1: openssh |
||
Check for the version of the openssh package Detailed Explanation for this Vulnerability Assessment The remote host is missing the patch for the advisory MDKSA-2002:040-1 (openssh). An input validation error exists in the OpenSSH server between versions 2.3.1 and 3.3 that can result in an integer overflow and privilege escalation. This error is found in the PAMAuthenticationViaKbdInt code in versions 2.3.1 to 3.3, and the ChallengeResponseAuthentication code in versions 2.9.9 to 3.3. OpenSSH 3.4 and later are not affected, and OpenSSH 3.2 and later prevent privilege escalation if UsePrivilegeSeparation is enabled in OpenSSH 3.3 and higher this is the default behaviour of OpenSSH. To protect yourself, users should be using OpenSSH 3.3 with UsePrivilegeSeparation enabled (see MDKSA:2002-040). However, it is highly recommended that all Mandrake Linux users upgrade to version 3.4 which corrects these errors. There are a few caveats with this upgrade, however, that users should be aware of: - On Linux kernel 2.2 (the default for Mandrake Linux 7.x), the use of Compression and UsePrivilegeSeparation are mutually exclusive. You can use one feature or the other, not both we recommend disabling Compression and using privsep until this can be resolved. - Using privsep may cause some PAM modules which expect to run with root privilege to fail. For instance, users will not be able to change their password if they attempt to log into an account with an expired password. If you absolutely must use one of these features that conflict with privsep, you can disable it in /etc/ssh/sshd_config by using: UsePrivilegeSeparation no However, if you do this, be sure you are running OpenSSH 3.4. Updates to OpenSSH will be made available once these problems are resolved. Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2002:040-1 Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security |
||
Cables, Connectors |
Cisco Systems NCS2K-20-SMRFS-L optical multiplexor CISCO EXCESS
$3599.00
Cisco SG110 24 Port Gigabit Ethernet Switch w/ 2 x SFP SG110-24
$117.00
Cisco RV320 Dual WAN VPN 4 Port Gigabit Router w/ Web Filtering RV320-WB-K9-NA
$374.00
Cisco 1100 Terminal - gateway - rack-mountable C1100TGX-1N24P32A
$1349.00
Cisco WS-C3850-48P-L 48-Port Gigabit 3850 PoE Switch w/ 715W+ C3850-NM-4-1G Mod
$83.00
Cisco C3850-NM-2-10G 2 Port Network Exp.Module for 3850
$38.99
Genuine Cisco SFP-10G-SR V03 10GBASE-SR SFP+ Transceiver Module 10-2415-03
$8.00
Cisco Catalyst WS-C2960-48TT-L V02 48 Port Fast Ethernet Switch
$34.00
Cisco C9300-48 48 Port Switch Dual PSU W/C9300-NM-8X P/N: C9300-48U-A Tested
$799.99
UNCLAIMED Cisco Meraki MS120-24P-HW - 24Ports Ethernet PoE Switch Same Day Ship
$315.00
|
||
No Discussions have been posted on this vulnerability. |