CVSS: 5.0EPSS: 0%CPEs: 62EXPL: 0CVE-2007-2243 – OpenSSH s/key Weakness
https://notcve.org/view.php?id=CVE-2007-2243
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483. OpenSSH 4.6 y anteriores, cuando ChallengeResponseAuthentication está habilitado, permite a atacantes remotos determinar la existencia de cuentas de usuario intentando autenticarse mediante S/KEY, lo cual muestra una respuesta diferente si la cuenta de usuario existe, un problema similar a CVE-2001-1483. OpenSSH, when configured to use S/KEY authentication, is prone to a remoteinformation disclosure weakness. • http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053906.html http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053951.html http://securityreason.com/securityalert/2631 http://www.osvdb.org/34600 http://www.securityfocus.com/bid/23601 https://exchange.xforce.ibmcloud.com/vulnerabilities/33794 https://security.netapp.com/advisory/ntap-20191107-0003 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2006-5794 – OpenSSH privilege separation flaw
https://notcve.org/view.php?id=CVE-2006-5794
Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist. Vulnerabilidad sin especificar en el sshd Privilege Separation Monitor en OpenSSH para versiones anteriores a la 4.5 que provoca una verificación más leve que la autenticación, y que podría permitir a atacantes remotos evitar la autenticación. NOTA: en el 20061108, se cree que es sólo explotada por el impulso de vulnerabilidades en un proceso sin privilegios, hasta ahora desconocidos. • ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc http://rhn.redhat.com/errata/RHSA-2006-0738.html http://secunia.com/advisories/22771 http://secunia.com/advisories/22772 http://secunia.com/advisories/22773 http://secunia.com/advisories/22778 http://secunia.com/advisories/22814 http://secunia.com/advisories/22872 http://secunia.com/advisories/22932 http://secunia.com/advisories/23513 http://secunia.com/advisories/23680 http://secunia.com/advisories&#x •
CVSS: 2.6EPSS: 1%CPEs: 2EXPL: 1CVE-2006-5229 – Portable OpenSSH 3.6.1p-PAM/4.1-SuSE - Timing Attack
https://notcve.org/view.php?id=CVE-2006-5229
OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds. OpenSSH portable 4.1 en SUSE Linux, y posiblemente en otras plataformas y versiones, y posiblemente bajo configuraciones limitadas, permite a atacantes remotos determinar nombres de usuario válidos mediante discrepancias de tiempo en las cuales las respuestas tardan más para nombres de usuario válidos que para los inválidos, como ha sido demostrado por sshtime. NOTA: a fecha de 14/10/2006, parece que este problema depende del uso de contraseñas configuradas manualmente que provoca retrasos procesando /etc/shadow debido a un incremento en el número de rondas. • https://www.exploit-db.com/exploits/3303 http://secunia.com/advisories/25979 http://www.osvdb.org/32721 http://www.securityfocus.com/archive/1/448025/100/0/threaded http://www.securityfocus.com/archive/1/448108/100/0/threaded http://www.securityfocus.com/archive/1/448156/100/0/threaded http://www.securityfocus.com/archive/1/448702/100/0/threaded http://www.securityfocus.com/bid/20418 http://www.sybsecurity.com/hack-proventia-1.pdf http://www.vupen.com/english • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 6%CPEs: 1EXPL: 1CVE-2006-4925
https://notcve.org/view.php?id=CVE-2006-4925
packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL. packet.c en ssh en OpenSSH permite a atacantes remotos provocar una denegación de servicio (caída) mediante el envío de una secuencia de protocolo inválida con USERAUTH_SUCCESS antes de NEWKEYS, lo que provoca que newkeys[mode] sea nulo (NULL). • http://bugs.gentoo.org/show_bug.cgi?id=148228 http://secunia.com/advisories/22245 http://secunia.com/advisories/22298 http://secunia.com/advisories/22495 http://secunia.com/advisories/23038 http://www.mandriva.com/security/advisories?name=MDKSA-2006:179 http://www.novell.com/linux/security/advisories/2006_24_sr.html http://www.novell.com/linux/security/advisories/2006_62_openssh.html http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/packet.c.diff?r1=1.144&r2=1& •
CVSS: 9.3EPSS: 92%CPEs: 6EXPL: 0CVE-2006-5051 – unsafe GSSAPI signal handler
https://notcve.org/view.php?id=CVE-2006-5051
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free. Condición de carrera en el manejador de señal OpenSSH en versiones anteriores a 4.4 permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente ejecutar código arbitrario si la autenticación GSSAPI está habilitada, a través de vectores no especificados que conducen a una doble liberación. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:22.openssh.asc ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://docs.info.apple.com/article.html?artnum=305214 http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html http://lists.freebsd.org/pipermail/freebsd-security/2006-October/004051.html http://marc.info/?l=openssh-unix-dev&m=115939141729160&w=2 http://openssh.org/txt/release-4.4 http://secunia.com/advisories& • CWE-415: Double Free •