Vulnerability Bulletins |
Desbordamiento de búfer en OpenSSH 3.7.1 y versiones anteriores |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Denegación de Servicio |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | OpenSSH <= 3.7.1 |
Description |
|
| Se ha descubierto una vulnerabilidad de desbordamiento de búfer en OpenSSH versions anteriores a la 3.7.1 que pueden permitir a un atacante remoto realizar un ataque de denegación de servicio contra el servidor OpenSSH. Este fallo reside en la gestión de los búfer en el archivo buffer.c de OpenSSH y es incierto si puede permitir a un atacante remoto ejecutar código arbitrario. | |
Solution |
|
|
Actualización de software Aplique los mecanismos de actualización propios de su sistema |
|
Standar resources |
|
| Property | Value |
| CVE | CAN-2003-0682 |
| BID | |
Other resources |
|
|
OpenSSH Security Advisory: buffer.adv. 16-09-2003 http://www.openssh.com/txt/buffer.adv Apple security article http://docs.info.apple.com/article.html?artnum=61798 OpenBSD security advisory dated September 2003, 16 http://www.openbsd.org/errata.html Caldera (SCO) security advisory CSSA-2003-SCO.24 dated November 4, 2003 ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.24/CSSA-2003-SCO.24.txt Cisco security advisory dated September 17, 2003 http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml FreeBSD security advisory SA-03:12 dated September 16, 2003 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:09.signal.asc Linux Debian DSA 382-1 security advisory dated September 16, 2003 http://www.debian.org/security/2003/dsa-382 Linux Debian security advisory DSA-383 dated September 17, 2003 http://www.debian.org/security/2003/ Linux Mandrake security advisory MDKSA-2003:090 dated September 16, 2003 http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:090 Linux Red Hat security advisory RHSA-2003:279-01 dated September 16, 2003 https://rhn.redhat.com/errata/RHSA-2003-279.html Linux slackware security advisory SSA:2003-253-01 dated September 16, 2003 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2003&m=slackware-security.374735 Linux SuSE security advisory SuSE-SA:2003:038 dated September 16, 2003 http://www.suse.de/de/security/announcements/index.html NetBSD security advisory NetBSD-SA2003-012 dated September 17, 2003 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-012.txt.asc SCO security advisory CSSA-2003-SCO.22 dated September 22, 2003 ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.22/CSSA-2003-SCO.22.txt SGI security advisory 20030904-01-P dated September 30, 2003 ftp://patches.sgi.com/support/free/security/advisories/20030904-01-P.asc |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2003-09-18 |