Test ID:	1.3.6.1.4.1.25623.1.0.52711
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2005:106
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory RHSA-2005:106. The scp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses scp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue. On systems where direct ssh access for the root user was disabled by configuration (setting PermitRootLogin no), attempts to guess the root password could be judged as sucessful or unsucessful by observing a delay. On systems where the privilege separation feature was turned on, the user resource limits were not correctly set if the configuration specified to raise them above the defaults. It was also not possible to change an expired password. Users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2005-106.html Risk factor : Medium CVSS Score: 4.3
Cross-Ref:	BugTraq ID: 9986 Common Vulnerability Exposure (CVE) ID: CVE-2004-0175 http://www.securityfocus.com/bid/9986 Computer Incident Advisory Center Bulletin: O-212 http://www.ciac.org/ciac/bulletins/o-212.shtml Conectiva Linux advisory: CLSA-2004:831 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000831 http://www.mandriva.com/security/advisories?name=MDKSA-2005:100 http://www.mandriva.com/security/advisories?name=MDVSA-2008:191 http://www.osvdb.org/9550 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10184 http://www.redhat.com/support/errata/RHSA-2005-074.html http://www.redhat.com/support/errata/RHSA-2005-106.html http://www.redhat.com/support/errata/RHSA-2005-165.html http://www.redhat.com/support/errata/RHSA-2005-481.html http://www.redhat.com/support/errata/RHSA-2005-495.html http://www.redhat.com/support/errata/RHSA-2005-562.html http://www.redhat.com/support/errata/RHSA-2005-567.html SCO Security Bulletin: SCOSA-2006.11 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt http://secunia.com/advisories/17135 http://secunia.com/advisories/19243 SuSE Security Announcement: SuSE-SA:2004:009 (Google Search) http://www.novell.com/linux/security/advisories/2004_09_kernel.html XForce ISS Database: openssh-scp-file-overwrite(16323) https://exchange.xforce.ibmcloud.com/vulnerabilities/16323
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.