ID de Prueba:	1.3.6.1.4.1.25623.1.0.123172
Categoría:	Oracle Linux Local Security Checks
Título:	Oracle: Security Advisory (ELSA-2015-0425)
Resumen:	The remote host is missing an update for the 'openssh' package(s) announced via the ELSA-2015-0425 advisory.
Descripción:	Summary: The remote host is missing an update for the 'openssh' package(s) announced via the ELSA-2015-0425 advisory. Vulnerability Insight: [6.6.1p1-11 + 0.9.3-9] - fix direction in CRYPTO_SESSION audit message (#1171248) [6.6.1p1-10 + 0.9.3-9] - add new option GSSAPIEnablek5users and disable using ~ /.k5users by default CVE-2014-9278 (#1169843) [6.6.1p1-9 + 0.9.3-9] - log via monitor in chroots without /dev/log (#1083482) [6.6.1p1-8 + 0.9.3-9] - increase size of AUDIT_LOG_SIZE to 256 (#1171163) - record pfs= field in CRYPTO_SESSION audit event (#1171248) [6.6.1p1-7 + 0.9.3-9] - fix gsskex patch to correctly handle MONITOR_REQ_GSSSIGN request (#1118005) [6.6.1p1-6 + 0.9.3-9] - correct the calculation of bytes for authctxt->krb5_ccname (#1161073)[6.6.1p1-5 + 0.9.3-9]- change audit trail for unknown users (#1158521)[6.6.1p1-4 + 0.9.3-9]- revert the default of KerberosUseKuserok back to yes- fix kuserok patch which checked for the existence of .k5login unconditionally and hence prevented other mechanisms to be used properly[6.6.1p1-3 + 0.9.3-9]- fix parsing empty options in sshd_conf- ignore SIGXFSZ in postauth monitor[6.6.1p1-2 + 0.9.3-9]- slightly change systemd units logic - use sshd-keygen.service (#1066615)- log when a client requests an interactive session and only sftp is allowed (#1130198)- sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)[6.6.1p1-1 + 0.9.3-9]- new upstream release (#1059667)- prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)- make /etc/ssh/moduli file public (#1134448)- test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service- don't clean up gssapi credentials by default (#1134447)- ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)- disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6- add support for ED25519 keys to sshd-keygen and sshd.sysconfig- standardise on NI_MAXHOST for gethostname() string lengths (#1097665)- set a client's address right after a connection is set (mindrot#2257) (#912792)- apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)- don't consider a partial success as a failure (mindrot#2270) (#1112972) Affected Software/OS: 'openssh' package(s) on Oracle Linux 7. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2653 BugTraq ID: 66459 http://www.securityfocus.com/bid/66459 Debian Security Information: DSA-2894 (Google Search) http://www.debian.org/security/2014/dsa-2894 http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html HPdes Security Advisory: HPSBUX03188 http://marc.info/?l=bugtraq&m=141576985122836&w=2 HPdes Security Advisory: SSRT101487 http://www.mandriva.com/security/advisories?name=MDVSA-2014:068 http://www.mandriva.com/security/advisories?name=MDVSA-2015:095 http://openwall.com/lists/oss-security/2014/03/26/7 RedHat Security Advisories: RHSA-2014:1552 http://rhn.redhat.com/errata/RHSA-2014-1552.html RedHat Security Advisories: RHSA-2015:0425 http://rhn.redhat.com/errata/RHSA-2015-0425.html http://secunia.com/advisories/59855 http://www.ubuntu.com/usn/USN-2164-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-9278 71420 http://www.securityfocus.com/bid/71420 RHSA-2015:0425 [oss-security] 20141202 CVE request: OpenSSH ~/.k5users patch (Fedora and downstreams) http://www.openwall.com/lists/oss-security/2014/12/02/3 [oss-security] 20141204 Re: CVE request: OpenSSH ~/.k5users patch (Fedora and downstreams) http://www.openwall.com/lists/oss-security/2014/12/04/17 http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855 https://bugzilla.mindrot.org/show_bug.cgi?id=1867 https://bugzilla.redhat.com/show_bug.cgi?id=1169843 openssh-gssservkrb5-sec-bypass(99090) https://exchange.xforce.ibmcloud.com/vulnerabilities/99090
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.