Vulnerability Bulletins |
Múltiples vulnerabilidades en OpenSSH |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Integridad |
| Dificulty | Experto |
| Required attacker level | Acceso remoto con cuenta |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software |
OpenSSH 4.3p2 OpenSSH < 4.9 Sun Solaris 10 Sun Solaris 9 HP-UX B.11.11 Secure Shell < A.05.00.012 HP-UX B.11.23 Secure Shell < A.05.00.013 HP-UX B.11.31 Secure Shell < A.05.00.014 IBM AIX 6.1 OpenSSH < 4.7.0.5301 IBM AIX 5.3 OpenSSH < 4.7.0.5301 IBM AIX 5.2 OpenSSH < 4.7.0.5201 |
Description |
|
|
Se han descubierto múltiples vulnerabilidades en OpenSSH . Las vulnerabilidades son descritas a continuación: - CVE-2008-1483: Se ha descubierto una vulnerabilidad en OpenSSH 4.3p2. La vulnerabilidad reside en un error al asignar el valor de la variable de entorno DISPLAY a ":10" en vez de otro valor cuando el puerto de redirección de sesiones "X11" está en uso en IPv4 pero no en IPv6. Un atacante local podría robar las credenciales de acceso (obtención de "MIT-MAGIC-COOKIE") y apropiarse de conexiones con redirección de sesiones "X11" escuchando al mismo puerto que se utiliza para redirigir una sesión X11 (TCP 6010 IPv4). - CVE-2008-1657: Se ha descubierto una vulnerabilidad en OpenSSH en versiones anteriores a la 4.9. La vulnerabilidad reside en un error en la implementación de la directiva "ForceCommand". Un atacante local podría saltarse la directiva "ForceCommand" y ejecutar comandos arbitrarios no permitidos mediante la modificación del fichero de sesión ".ssh/rc". |
|
Solution |
|
|
Actualización de software Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux. Sun (237444) Solaris 9 / SPARC / patch 114356-14 Solaris 10 / SPARC / patch 126133-03 Solaris 9 / x86 / patch 114357-13 Solaris 10 / x86 / patch 126134-03 http://sunsolve.sun.com/pub-cgi/show.pl?target=patchpage Debian (DSA-1576-1) Debian Linux 4.0 Source http://security.debian.org/pool/updates/main/o/openssh/openssh_4.3p2-9etch1.diff.gz http://security.debian.org/pool/updates/main/o/openssh-blacklist/openssh-blacklist_0.1.1.tar.gz http://security.debian.org/pool/updates/main/o/openssh/openssh_4.3p2-9etch1.dsc http://security.debian.org/pool/updates/main/o/openssh-blacklist/openssh-blacklist_0.1.1.dsc http://security.debian.org/pool/updates/main/o/openssh/openssh_4.3p2.orig.tar.gz Arquitectura independiente http://security.debian.org/pool/updates/main/o/openssh-blacklist/openssh-blacklist_0.1.1_all.deb http://security.debian.org/pool/updates/main/o/openssh/ssh_4.3p2-9etch1_all.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-krb5_4.3p2-9etch1_all.deb alpha (DEC Alpha) http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_alpha.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_alpha.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_alpha.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_alpha.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_alpha.deb amd64 (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_amd64.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_amd64.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_amd64.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_amd64.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_amd64.deb hppa (HP PA RISC) http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_hppa.udeb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_hppa.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_hppa.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_hppa.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_hppa.deb i386 (Intel ia32) http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_i386.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_i386.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_i386.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_i386.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_i386.udeb ia64 (Intel ia64) http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_ia64.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_ia64.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_ia64.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_ia64.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_ia64.deb powerpc (PowerPC) http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_powerpc.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_powerpc.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_powerpc.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_powerpc.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_powerpc.udeb sparc (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/o/openssh/openssh-server_4.3p2-9etch1_sparc.deb http://security.debian.org/pool/updates/main/o/openssh/ssh-askpass-gnome_4.3p2-9etch1_sparc.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-client_4.3p2-9etch1_sparc.deb http://security.debian.org/pool/updates/main/o/openssh/openssh-server-udeb_4.3p2-9etch1_sparc.udeb http://security.debian.org/pool/updates/main/o/openssh/openssh-client-udeb_4.3p2-9etch1_sparc.udeb Hewlett-Packard (HPSBUX02337) HP-UX B.11.11 (11i v1) Secure Shell A.05.00.012 HP-UX B.11.23 (11i v2) Secure Shell A.05.00.013 HP-UX B.11.31 (11i v3) Secure Shell A.05.00.014 http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA IBM AIX 5.2 OpenSSH http://downloads.sourceforge.net/openssh-aix/openssh-4.7_5201.tar.Z AIX 5.3 OpenSSH http://downloads.sourceforge.net/openssh-aix/openssh-4.7_5301.tar.Z AIX 6.1 OpenSSH http://downloads.sourceforge.net/openssh-aix/openssh-4.7_5301aix61.tar.Z |
|
Standar resources |
|
| Property | Value |
| CVE |
CVE-2008-1483 CVE-2008-1657 |
| BID |
28444 28531 |
Other resources |
|
|
SUSE Security Advisory (SUSE-SR:2008:009) http://www.novell.com/linux/security/advisories/2008_9_sr.html Sun Alert Notification (237444) http://sunsolve.sun.com/search/document.do?assetkey=1-66-237444-1 Debian Security Advisory (DSA-1576-1) http://lists.debian.org/debian-security-announce/2008/msg00153.html HP SECURITY BULLETIN (HPSBUX02337) https://www12.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01462841-1 IBM Security Advisory http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX61&path=/200805/SECURITY/20080521/datafile115307 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2008-04-15 |
| 1.1 | Aviso emitido por Sun (237444) | 2008-05-14 |
| 1.2 | Aviso emitido por Debian (DSA-1576-1) | 2008-05-15 |
| 1.3 | Aviso emitido por HP (HPSBUX02337), aviso emitido por IBM | 2008-05-22 |
| 1.4 | Aviso actualizado por Sun (237444) | 2008-05-28 |
| 1.5 | Aviso actualizado por Sun (237444) | 2008-07-03 |