CVSS: 7.5EPSS: 1%CPEs: 78EXPL: 1CVE-2010-4478
https://notcve.org/view.php?id=CVE-2010-4478
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252. OpenSSH v5.6 y versiones anteriores, si J-PAKE está activo, no valida apropiadamente los parámetros públicos en el protocolo J-PAKE, lo que permite a atacantes remotos evitar la necesidad de conocer el secreto compartido, y autenticarse con éxito, enviando valores modificados en cada turno del protocolo. Relacionado con CVE-2010-4252. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673 http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c#rev1.5 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c.diff?r1=1.4%3Br2=1.5%3Bf=h https://bugzilla.redhat.com/show_bug.cgi?id=659297 https://github.com/seb-m/jpake https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12338 • CWE-287: Improper Authentication •
CVSS: 1.2EPSS: 0%CPEs: 71EXPL: 0CVE-2008-3259
https://notcve.org/view.php?id=CVE-2008-3259
OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform. OpenSSH anterior a 5.1 activa la opción del socket SO_REUSEADDR cuando la configuración X11UseLocalhost está desactivada, lo que permite a usuarios locales en determinadas plataformas, secuestrar el puerto de reenvío X11 a través de una única dirección IP como se ha demostrado sobre la plataforma HP-UX. • http://openssh.com/security.html http://secunia.com/advisories/31179 http://www.openssh.com/txt/release-5.1 http://www.securityfocus.com/bid/30339 http://www.securitytracker.com/id?1020537 http://www.vupen.com/english/advisories/2008/2148 https://exchange.xforce.ibmcloud.com/vulnerabilities/43940 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •