[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

CESA-2016:0741 -- centos 6 openssh

ID: oval:org.secpod.oval:def:204168Date: (C)2017-02-23   (M)2024-02-19
Class: PATCHFamily: unix




OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: * It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. * A flaw was found in the way OpenSSH handled PAM authentication when using privilege separation. An attacker with valid credentials on the system and able to fully compromise a non-privileged pre-authentication process using a different flaw could use this flaw to authenticate as other users. * A use-after-free flaw was found in OpenSSH. An attacker able to fully compromise a non-privileged pre-authentication process using a different flaw could possibly cause sshd to crash or execute arbitrary code with root privileges. * An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested. For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

Platform:
CentOS 6
Product:
openssh
Reference:
CESA-2016:0741
CVE-2015-5352
CVE-2015-6563
CVE-2015-6564
CVE-2016-1908
CVE    4
CVE-2016-1908
CVE-2015-5352
CVE-2015-6564
CVE-2015-6563
...
CPE    4
cpe:/o:centos:centos:6
cpe:/a:openbsd:openssh:6.8
cpe:/a:openbsd:openssh
cpe:/a:openbsd:openssh:6.9
...

© SecPod Technologies