|
|
Family: Red Hat Local Security Checks --> Category: infos
RHSA-2006-0738: openssh Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the openssh packages
Detailed Explanation for this Vulnerability Test
Updated openssh packages that fix an authentication flaw are now available
for Red Hat Enterprise Linux 3 and 4.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.
An authentication flaw was found in OpenSSH's privilege separation monitor.
If it ever becomes possible to alter the behavior of the unprivileged
process when OpenSSH is using privilege separation, a possible hacker may then be
able to login without possessing proper credentials. (CVE-2006-5794)
Please note that this flaw by itself poses no direct threat to OpenSSH
users. Without another security flaw that could allow a possible hacker to alter
the behavior of OpenSSH's unprivileged process, this flaw cannot be
exploited. There are currently no known flaws to exploit this behavior.
However, we have decided to issue this erratum to fix this flaw to reduce
the security impact if an unprivileged process flaw is ever found.
Users of openssh should upgrade to these updated packages, which contain a
backported patch to resolve this issue.
Solution : http://rhn.redhat.com/errata/RHSA-2006-0738.html
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
