Vulnerabilities > CVE-2019-6110 - Inappropriate Encoding for Output Context vulnerability in multiple products

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

high complexity

nessus

exploit available

NVD

Published: 2019-01-31

Updated: 2023-02-23

Summary

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

Vulnerable Configurations

Part	Description	Count
Application	Openbsd Openbsd Openssh - Openbsd Openssh 1.2 Openbsd Openssh 1.2.1 Openbsd Openssh 1.2.2 Openbsd Openssh 1.2.3 Openbsd Openssh 1.2.27 Openbsd Openssh 1.3 Openbsd Openssh 1.5 Openbsd Openssh 1.5.7 Openbsd Openssh 1.5.8 Openbsd Openssh 2 Openbsd Openssh 2.1 Openbsd Openssh 2.1.0 Openbsd Openssh 2.1.1 Openbsd Openssh 2.2 Openbsd Openssh 2.2.0 Openbsd Openssh 2.3 Openbsd Openssh 2.3.0 Openbsd Openssh 2.3.1 Openbsd Openssh 2.5 Openbsd Openssh 2.5.1 Openbsd Openssh 2.5.2 Openbsd Openssh 2.9 Openbsd Openssh 2.9.9 Openbsd Openssh 2.9.9P2 Openbsd Openssh 2.9P1 Openbsd Openssh 2.9P2 Openbsd Openssh 3.0 Openbsd Openssh 3.0.1 Openbsd Openssh 3.0.1P1 Openbsd Openssh 3.0.2 Openbsd Openssh 3.0.2P1 Openbsd Openssh 3.0P1 Openbsd Openssh 3.1 Openbsd Openssh 3.1P1 Openbsd Openssh 3.2 Openbsd Openssh 3.2.2 Openbsd Openssh 3.2.2P1 Openbsd Openssh 3.2.3 Openbsd Openssh 3.2.3P1 Openbsd Openssh 3.3 Openbsd Openssh 3.3P1 Openbsd Openssh 3.4 Openbsd Openssh 3.4P1 Openbsd Openssh 3.5 Openbsd Openssh 3.5P1 Openbsd Openssh 3.6 Openbsd Openssh 3.6.1 Openbsd Openssh 3.6.1P1 Openbsd Openssh 3.6.1P2 Openbsd Openssh 3.7 Openbsd Openssh 3.7.1 Openbsd Openssh 3.7.1P1 Openbsd Openssh 3.7.1P2 Openbsd Openssh 3.8 Openbsd Openssh 3.8.1 Openbsd Openssh 3.8.1P1 Openbsd Openssh 3.9 Openbsd Openssh 3.9.1 Openbsd Openssh 3.9.1P1 Openbsd Openssh 4.0 Openbsd Openssh 4.0P1 Openbsd Openssh 4.1 Openbsd Openssh 4.1P1 Openbsd Openssh 4.2 Openbsd Openssh 4.2P1 Openbsd Openssh 4.3 Openbsd Openssh 4.3P1 Openbsd Openssh 4.3P2 Openbsd Openssh 4.4 Openbsd Openssh 4.4P1 Openbsd Openssh 4.5 Openbsd Openssh 4.6 Openbsd Openssh 4.7 Openbsd Openssh 4.7P1 Openbsd Openssh 4.8 Openbsd Openssh 4.9 Openbsd Openssh 5.0 Openbsd Openssh 5.1 Openbsd Openssh 5.2 Openbsd Openssh 5.3 Openbsd Openssh 5.4 Openbsd Openssh 5.5 Openbsd Openssh 5.6 Openbsd Openssh 5.7 Openbsd Openssh 5.8 Openbsd Openssh 5.8P2 Openbsd Openssh 5.9 Openbsd Openssh 6.0 Openbsd Openssh 6.1 Openbsd Openssh 6.2 Openbsd Openssh 6.3 Openbsd Openssh 6.4 Openbsd Openssh 6.5 Openbsd Openssh 6.6 Openbsd Openssh 6.7 Openbsd Openssh 6.8 Openbsd Openssh 6.9 Openbsd Openssh 7.0 Openbsd Openssh 7.1 Openbsd Openssh 7.2 Openbsd Openssh 7.3 Openbsd Openssh 7.4 Openbsd Openssh 7.5 Openbsd Openssh 7.6 Openbsd Openssh 7.7 Openbsd Openssh 7.8 Openbsd Openssh 7.9	243
Application	Winscp Winscp Winscp 2.0 Winscp Winscp 2.1 Winscp Winscp 2.2 Winscp Winscp 2.2.3 Winscp Winscp 2.3 Winscp Winscp 3.0 Winscp Winscp 3.1 Winscp Winscp 3.2 Winscp Winscp 3.2.1 Winscp Winscp 3.3 Winscp Winscp 3.4 Winscp Winscp 3.4.1 Winscp Winscp 3.4.2 Winscp Winscp 3.5 Winscp Winscp 3.5.5 Winscp Winscp 3.5.6 Winscp Winscp 3.6 Winscp Winscp 3.6.1 Winscp Winscp 3.6.5 Winscp Winscp 3.6.6 Winscp Winscp 3.6.7 Winscp Winscp 3.6.8 Winscp Winscp 3.7 Winscp Winscp 3.7.1 Winscp Winscp 3.7.2 Winscp Winscp 3.7.3 Winscp Winscp 3.7.4 Winscp Winscp 3.7.5 Winscp Winscp 3.7.6 Winscp Winscp 3.8 Winscp Winscp 3.8.1 Winscp Winscp 3.8.2 Winscp Winscp 3.8_Beta Winscp Winscp 4.0 Winscp Winscp 4.0.1 Winscp Winscp 4.0.2 Winscp Winscp 4.0.3 Winscp Winscp 4.0.4 Winscp Winscp 4.0.5 Winscp Winscp 4.0.6 Winscp Winscp 4.0.7 Winscp Winscp 4.1 Winscp Winscp 4.1.1 Winscp Winscp 4.1.2 Winscp Winscp 4.1.3 Winscp Winscp 4.1.4 Winscp Winscp 4.1.5 Winscp Winscp 4.1.6 Winscp Winscp 4.1.7 Winscp Winscp 4.1.8 Winscp Winscp 4.1.9 Winscp Winscp 4.2 Winscp Winscp 4.2.1 Winscp Winscp 4.2.2 Winscp Winscp 4.2.3 Winscp Winscp 4.2.4 Winscp Winscp 4.2.5 Winscp Winscp 4.2.6 Winscp Winscp 4.2.7 Winscp Winscp 4.2.8 Winscp Winscp 4.2.9 Winscp Winscp 4.3 Winscp Winscp 4.3.1 Winscp Winscp 4.3.2 Winscp Winscp 4.3.3 Winscp Winscp 4.3.4 Winscp Winscp 4.3.5 Winscp Winscp 4.3.6 Winscp Winscp 4.3.7 Winscp Winscp 4.3.8 Winscp Winscp 4.3.9 Winscp Winscp 4.4 Winscp Winscp 4.4.0 Winscp Winscp 5.0 Winscp Winscp 5.0.1 Winscp Winscp 5.0.2 Winscp Winscp 5.0.3 Winscp Winscp 5.0.4 Winscp Winscp 5.0.5 Winscp Winscp 5.0.6 Winscp Winscp 5.0.7 Winscp Winscp 5.0.8 Winscp Winscp 5.0.9 Winscp Winscp 5.1 Winscp Winscp 5.1.1 Winscp Winscp 5.1.2 Winscp Winscp 5.1.3 Winscp Winscp 5.1.4 Winscp Winscp 5.1.5 Winscp Winscp 5.1.6 Winscp Winscp 5.1.7 Winscp Winscp 5.1.8 Winscp Winscp 5.2 Winscp Winscp 5.2.1 Winscp Winscp 5.2.2 Winscp Winscp 5.2.3 Winscp Winscp 5.2.4 Winscp Winscp 5.2.5 Winscp Winscp 5.2.6 Winscp Winscp 5.2.7 Winscp Winscp 5.5 Winscp Winscp 5.5.1 Winscp Winscp 5.5.2 Winscp Winscp 5.5.3 Winscp Winscp 5.5.4 Winscp Winscp 5.5.5 Winscp Winscp 5.5.6 Winscp Winscp 5.6 Winscp Winscp 5.6.1 Winscp Winscp 5.6.2 Winscp Winscp 5.6.3 Winscp Winscp 5.6.4 Winscp Winscp 5.6.5 Winscp Winscp 5.7 Winscp Winscp 5.7.1 Winscp Winscp 5.7.2 Winscp Winscp 5.7.3 Winscp Winscp 5.7.4 Winscp Winscp 5.7.5 Winscp Winscp 5.7.6 Winscp Winscp 5.7.7 Winscp Winscp 5.8 Winscp Winscp 5.8.1 Winscp Winscp 5.8.2 Winscp Winscp 5.8.3 Winscp Winscp 5.8.4 Winscp Winscp 5.9 Winscp Winscp 5.9.1 Winscp Winscp 5.9.2 Winscp Winscp 5.9.3 Winscp Winscp 5.9.4 Winscp Winscp 5.9.5 Winscp Winscp 5.9.6 Winscp Winscp 5.10.1 Winscp Winscp 5.10.2 Winscp Winscp 5.10.3 Winscp Winscp 5.10.4 Winscp Winscp 5.11 Winscp Winscp 5.11.1 Winscp Winscp 5.11.2 Winscp Winscp 5.11.3 Winscp Winscp 5.12 Winscp Winscp 5.12.1 Winscp Winscp 5.12.2 Winscp Winscp 5.13	145
Application	Netapp Netapp Element Software - Netapp Storage Automation Store - Netapp Ontap Select Deploy -	3
OS	Siemens Siemens Scalance X204Rna Firmware - Siemens Scalance X204Rna EEC Firmware -	2
Hardware	Siemens Siemens Scalance X204Rna - Siemens Scalance X204Rna EEC -	2

Common Weakness Enumeration (CWE)

CWE-838 - Inappropriate Encoding for Output Context

Common Attack Pattern Enumeration and Classification (CAPEC)

Generic Cross-Browser Cross-Domain Theft
An attacker makes use of Cascading Style Sheets (CSS) injection to steal data cross domain from the victim's browser. The attack works by abusing the standards relating to loading of CSS: 1. Send cookies on any load of CSS (including cross-domain) 2. When parsing returned CSS ignore all data that does not make sense before a valid CSS descriptor is found by the CSS parser By having control of some text in the victim's domain, the attacker is able to inject a seemingly valid CSS string. It does not matter if this CSS string is preceded by other data. The CSS parser will still locate the CSS string. If the attacker is able to control two injection points, one before the cross domain data that the attacker is interested in receiving and the other one after, the attacker can use this attack to steal all of the data in between these two CSS injection points when referencing the injected CSS while performing rendering on the site that the attacker controls. When rendering, the CSS parser will detect the valid CSS string to parse and ignore the data that "does not make sense". That data will simply be rendered. That data is in fact the data that the attacker just stole cross domain. The stolen data may contain sensitive information, such CSRF protection tokens.

Exploit-Db

id EDB-ID:46516
last seen 2019-03-07
modified 2019-01-11
published 2019-01-11
reporter Exploit-DB
source https://www.exploit-db.com/download/46516
title OpenSSH SCP Client - Write Arbitrary Files

file	exploits/multiple/remote/46193.py
id	EDB-ID:46193
last seen	2019-01-18
modified	2019-01-18
platform	multiple
port
published	2019-01-18
reporter	Exploit-DB
source	https://www.exploit-db.com/download/46193
title	SCP Client - Multiple Vulnerabilities (SSHtranger Things)
type	remote

Nessus

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0132-1.NASL
description	This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-01-22
plugin id	121300
published	2019-01-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121300
title	SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2019:0132-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:0132-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(121300); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_name(english:"SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2019:0132-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121571" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121816" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121818" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121821" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20685/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6109/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6110/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6111/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20190132-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?2f3bb078" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE OpenStack Cloud 7:zypper in -t patch SUSE-OpenStack-Cloud-7-2019-132=1 SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch SUSE-SLE-SAP-12-SP2-2019-132=1 SUSE Linux Enterprise Server 12-SP4:zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-132=1 SUSE Linux Enterprise Server 12-SP3:zypper in -t patch SUSE-SLE-SERVER-12-SP3-2019-132=1 SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP2-2019-132=1 SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2019-132=1 SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-132=1 SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2019-132=1 SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2019-132=1 SUSE CaaS Platform ALL : To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. SUSE CaaS Platform 3.0 : To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. OpenStack Cloud Magnum Orchestration 7:zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-132=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-fips"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/01/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLED12\|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES12" && (! preg(pattern:"^(2\|3\|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP2/3/4", os_ver + " SP" + sp); if (os_ver == "SLED12" && (! preg(pattern:"^(3\|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-askpass-gnome-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-askpass-gnome-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-debugsource-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-fips-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-helpers-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"openssh-helpers-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-askpass-gnome-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-askpass-gnome-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-debugsource-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-fips-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-helpers-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"openssh-helpers-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-askpass-gnome-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-askpass-gnome-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-debugsource-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-fips-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-helpers-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"openssh-helpers-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-askpass-gnome-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-askpass-gnome-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-debugsource-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-fips-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-helpers-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"openssh-helpers-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-askpass-gnome-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-askpass-gnome-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-debugsource-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-helpers-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"openssh-helpers-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-askpass-gnome-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-askpass-gnome-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-debuginfo-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-debugsource-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-helpers-7.2p2-74.35.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"openssh-helpers-debuginfo-7.2p2-74.35.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0125-1.NASL
description	This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-01-22
plugin id	121295
published	2019-01-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121295
title	SUSE SLES12 Security Update : openssh (SUSE-SU-2019:0125-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:0125-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(121295); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_name(english:"SUSE SLES12 Security Update : openssh (SUSE-SU-2019:0125-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121571" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121816" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121818" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121821" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20685/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6109/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6110/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6111/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20190125-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?8367f10f" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-125=1 SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-2019-125=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-fips"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/01/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES12" && (! preg(pattern:"^(0\|1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0/1", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-askpass-gnome-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-askpass-gnome-debuginfo-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-debuginfo-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-debugsource-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-fips-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-helpers-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"openssh-helpers-debuginfo-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-askpass-gnome-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-askpass-gnome-debuginfo-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-debuginfo-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-debugsource-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-fips-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-helpers-6.6p1-54.26.1")) flag++; if (rpm_check(release:"SLES12", sp:"0", reference:"openssh-helpers-debuginfo-6.6p1-54.26.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0237_OPENSSH.NASL
description	An update of the openssh package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	126199
published	2019-06-25
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126199
title	Photon OS 1.0: Openssh PHSA-2019-1.0-0237
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory PHSA-2019-1.0-0237. The text # itself is copyright (C) VMware, Inc. include("compat.inc"); if (description) { script_id(126199); script_version("1.2"); script_cvs_date("Date: 2019/06/26 10:34:07"); script_cve_id("CVE-2019-6110"); script_bugtraq_id(106358); script_name(english:"Photon OS 1.0: Openssh PHSA-2019-1.0-0237"); script_summary(english:"Checks the rpm output for the updated packages."); script_set_attribute(attribute:"synopsis", value: "The remote PhotonOS host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "An update of the openssh package has been released."); script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-1.0-237.md"); script_set_attribute(attribute:"solution", value: "Update the affected Linux packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-12735"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/07"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/25"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:openssh"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:1.0"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"PhotonOS Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/PhotonOS/release"); if (isnull(release) \|\| release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS"); if (release !~ "^VMware Photon (?:Linux\|OS) 1\.0(\D\|$)") audit(AUDIT_OS_NOT, "PhotonOS 1.0"); if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu); flag = 0; if (rpm_check(release:"PhotonOS-1.0", reference:"openssh-7.4p1-10.ph1")) flag++; if (rpm_check(release:"PhotonOS-1.0", reference:"openssh-debuginfo-7.4p1-10.ph1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-91.NASL
description	This update for openssh fixes the following issues : Security issues fixed : - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) - CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) - CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-03-18
modified	2019-01-29
plugin id	121430
published	2019-01-29
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121430
title	openSUSE Security Update : openssh (openSUSE-2019-91)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2019-91. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(121430); script_version("1.6"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/20"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_name(english:"openSUSE Security Update : openssh (openSUSE-2019-91)"); script_summary(english:"Check for the openSUSE-2019-91 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for openssh fixes the following issues : Security issues fixed : - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) - CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) - CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) This update was imported from the SUSE:SLE-15:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121571" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121816" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121818" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121821" ); script_set_attribute( attribute:"solution", value:"Update the affected openssh packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-askpass-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-askpass-gnome-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-cavs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-cavs-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-fips"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-helpers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-helpers-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/03/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/29"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE15.0", reference:"openssh-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-cavs-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-cavs-debuginfo-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-debuginfo-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-debugsource-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-fips-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-helpers-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"openssh-helpers-debuginfo-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"openssh-askpass-gnome-7.6p1-lp150.8.9.1") ) flag++; if ( rpm_check(release:"SUSE15.0", cpu:"x86_64", reference:"openssh-askpass-gnome-debuginfo-7.6p1-lp150.8.9.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh-askpass-gnome / openssh-askpass-gnome-debuginfo / openssh / etc"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-13931-1.NASL
description	This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-01-22
plugin id	121306
published	2019-01-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121306
title	SUSE SLES11 Security Update : openssh (SUSE-SU-2019:13931-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:13931-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(121306); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_name(english:"SUSE SLES11 Security Update : openssh (SUSE-SU-2019:13931-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121571" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121816" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121818" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121821" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20685/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6109/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6110/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6111/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-201913931-1.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?af257c04" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Server 11-SP4:zypper in -t patch slessp4-openssh-13931=1 SUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch dbgsp4-openssh-13931=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-fips"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/01/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES11", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES11" && (! preg(pattern:"^(4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP4", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES11", sp:"4", reference:"openssh-6.6p1-36.12.1")) flag++; if (rpm_check(release:"SLES11", sp:"4", reference:"openssh-askpass-gnome-6.6p1-36.12.1")) flag++; if (rpm_check(release:"SLES11", sp:"4", reference:"openssh-fips-6.6p1-36.12.1")) flag++; if (rpm_check(release:"SLES11", sp:"4", reference:"openssh-helpers-6.6p1-36.12.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-93.NASL
description	This update for openssh fixes the following issues : Security issue fixed : - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) - CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) - CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) This update was imported from the SUSE:SLE-12-SP2:Update update project.
last seen	2020-03-18
modified	2019-01-30
plugin id	121460
published	2019-01-30
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121460
title	openSUSE Security Update : openssh (openSUSE-2019-93)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2019-93. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(121460); script_version("1.5"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/20"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_name(english:"openSUSE Security Update : openssh (openSUSE-2019-93)"); script_summary(english:"Check for the openSUSE-2019-93 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for openssh fixes the following issues : Security issue fixed : - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) - CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) - CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) This update was imported from the SUSE:SLE-12-SP2:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121571" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121816" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121818" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1121821" ); script_set_attribute( attribute:"solution", value:"Update the affected openssh packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-askpass-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-askpass-gnome-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-cavs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-cavs-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-fips"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-helpers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openssh-helpers-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/01/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/30"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE42.3", reference:"openssh-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-askpass-gnome-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-askpass-gnome-debuginfo-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-cavs-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-cavs-debuginfo-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-debuginfo-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-debugsource-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-fips-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-helpers-7.2p2-29.1") ) flag++; if ( rpm_check(release:"SUSE42.3", reference:"openssh-helpers-debuginfo-7.2p2-29.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh-askpass-gnome / openssh-askpass-gnome-debuginfo / openssh / etc"); }

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-2_0-0165_OPENSSH.NASL
description	An update of the openssh package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	126107
published	2019-06-24
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126107
title	Photon OS 2.0: Openssh PHSA-2019-2.0-0165
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory PHSA-2019-2.0-0165. The text # itself is copyright (C) VMware, Inc. include("compat.inc"); if (description) { script_id(126107); script_version("1.2"); script_cvs_date("Date: 2019/06/26 10:34:07"); script_cve_id("CVE-2019-6110"); script_bugtraq_id(106836); script_name(english:"Photon OS 2.0: Openssh PHSA-2019-2.0-0165"); script_summary(english:"Checks the rpm output for the updated packages."); script_set_attribute(attribute:"synopsis", value: "The remote PhotonOS host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "An update of the openssh package has been released."); script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-2-165.md"); script_set_attribute(attribute:"solution", value: "Update the affected Linux packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-13259"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/05"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/24"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:openssh"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:2.0"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"PhotonOS Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/PhotonOS/release"); if (isnull(release) \|\| release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS"); if (release !~ "^VMware Photon (?:Linux\|OS) 2\.0(\D\|$)") audit(AUDIT_OS_NOT, "PhotonOS 2.0"); if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu); flag = 0; if (rpm_check(release:"PhotonOS-2.0", reference:"openssh-7.5p1-14.ph2")) flag++; if (rpm_check(release:"PhotonOS-2.0", reference:"openssh-clients-7.5p1-14.ph2")) flag++; if (rpm_check(release:"PhotonOS-2.0", reference:"openssh-debuginfo-7.5p1-14.ph2")) flag++; if (rpm_check(release:"PhotonOS-2.0", reference:"openssh-server-7.5p1-14.ph2")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0060_OPENSSH.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssh packages installed that are affected by multiple vulnerabilities: - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. (CVE-2018-20685) - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. (CVE-2019-6109) - In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. (CVE-2019-6110) - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man- in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). (CVE-2019-6111) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	127253
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127253
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssh Multiple Vulnerabilities (NS-SA-2019-0060)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from ZTE advisory NS-SA-2019-0060. The text # itself is copyright (C) ZTE, Inc. include("compat.inc"); if (description) { script_id(127253); script_version("1.2"); script_cvs_date("Date: 2019/09/24 11:01:33"); script_cve_id( "CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111" ); script_bugtraq_id(106531); script_name(english:"NewStart CGSL CORE 5.04 / MAIN 5.04 : openssh Multiple Vulnerabilities (NS-SA-2019-0060)"); script_set_attribute(attribute:"synopsis", value: "The remote machine is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssh packages installed that are affected by multiple vulnerabilities: - In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. (CVE-2018-20685) - An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. (CVE-2019-6109) - In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. (CVE-2019-6110) - An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man- in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). (CVE-2019-6111) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0060"); script_set_attribute(attribute:"solution", value: "Upgrade the vulnerable CGSL openssh packages. Note that updated packages may not be available yet. Please contact ZTE for more information."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/07/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/12"); script_set_attribute(attribute:"plugin_type", value:"local"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"NewStart CGSL Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/ZTE-CGSL/release"); if (isnull(release) \|\| release !~ "^CGSL (MAIN\|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux"); if (release !~ "CGSL CORE 5.04" && release !~ "CGSL MAIN 5.04") audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04'); if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu); flag = 0; pkgs = { "CGSL CORE 5.04": [ "openssh-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-askpass-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-cavs-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-clients-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-debuginfo-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-keycat-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-ldap-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-server-7.9p1-1.el7.cgslv5.0.7.ga049176", "pam_ssh_agent_auth-0.10.3-6.1.el7.cgslv5.0.7.ga049176" ], "CGSL MAIN 5.04": [ "openssh-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-askpass-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-cavs-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-clients-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-debuginfo-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-keycat-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-ldap-7.9p1-1.el7.cgslv5.0.7.ga049176", "openssh-server-7.9p1-1.el7.cgslv5.0.7.ga049176", "pam_ssh_agent_auth-0.10.3-6.1.el7.cgslv5.0.7.ga049176" ] }; pkg_list = pkgs[release]; foreach (pkg in pkg_list) if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0126-1.NASL
description	This update for openssh fixes the following issues : Security issues fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-01-22
plugin id	121296
published	2019-01-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121296
title	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2019:0126-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:0126-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(121296); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_name(english:"SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2019:0126-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for openssh fixes the following issues : Security issues fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816) CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818) CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121571" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121816" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121818" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1121821" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20685/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6109/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6110/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-6111/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20190126-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?8e5cb3b1" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Module for Server Applications 15:zypper in -t patch SUSE-SLE-Module-Server-Applications-15-2019-126=1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2019-126=1 SUSE Linux Enterprise Module for Desktop Applications 15:zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2019-126=1 SUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-126=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-askpass-gnome-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-cavs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-cavs-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-fips"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openssh-helpers-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/01/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLED15\|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0", os_ver + " SP" + sp); if (os_ver == "SLED15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP0", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-debugsource-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-fips-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-cavs-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-cavs-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-debugsource-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-askpass-gnome-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-askpass-gnome-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-debugsource-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-helpers-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"openssh-helpers-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-cavs-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-cavs-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-debugsource-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-askpass-gnome-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-askpass-gnome-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-debuginfo-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-debugsource-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-helpers-7.6p1-9.13.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"openssh-helpers-debuginfo-7.6p1-9.13.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openssh"); }

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201903-16.NASL
description	The remote host is affected by the vulnerability described in GLSA-201903-16 (OpenSSH: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could overwrite arbitrary files, transfer malicious files, or gain unauthorized access. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	122990
published	2019-03-21
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122990
title	GLSA-201903-16 : OpenSSH: Multiple vulnerabilities
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201903-16. # # The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(122990); script_version("1.3"); script_cvs_date("Date: 2020/02/03"); script_cve_id("CVE-2018-20685", "CVE-2019-6109", "CVE-2019-6110", "CVE-2019-6111"); script_xref(name:"GLSA", value:"201903-16"); script_name(english:"GLSA-201903-16 : OpenSSH: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201903-16 (OpenSSH: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in OpenSSH. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could overwrite arbitrary files, transfer malicious files, or gain unauthorized access. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201903-16" ); script_set_attribute( attribute:"solution", value: "All OpenSSH users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=net-misc/openssh-7.9_p1-r4'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6111"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:openssh"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/03/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/03/21"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"net-misc/openssh", unaffected:make_list("ge 7.9_p1-r4"), vulnerable:make_list("lt 7.9_p1-r4"))) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get()); else security_warning(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "OpenSSH"); }

Packetstorm

data source	https://packetstormsecurity.com/files/download/151227/sshtrangerthings-fileadd.txt
id	PACKETSTORM:151227
last seen	2019-01-19
published	2019-01-18
reporter	Mark E. Haase
source	https://packetstormsecurity.com/files/151227/SSHtranger-Things-SCP-Client-File-Issue.html
title	SSHtranger Things SCP Client File Issue

The Hacker News

id	THN:445A5A09D3930F981A45FE5AFA1E4CEC
last seen	2019-01-15
modified	2019-01-15
published	2019-01-15
reporter	The Hacker News
source	https://thehackernews.com/2019/01/scp-software-vulnerabilities.html
title	36-Year-Old SCP Clients' Implementation Flaws Discovered

id	EDB-ID:46516
last seen	2019-03-07
modified	2019-01-11
published	2019-01-11
reporter	Exploit-DB
source	https://www.exploit-db.com/download/46516
title	OpenSSH SCP Client - Write Arbitrary Files

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Nessus

Packetstorm

The Hacker News

References