ID de Prueba:	1.3.6.1.4.1.25623.1.0.55525
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2005:527
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2005:527. OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. An error in the way OpenSSH handled GSSAPI credential delegation was discovered. OpenSSH as distributed with Red Hat Enterprise Linux 4 contains support for GSSAPI user authentication, typically used for supporting Kerberos. On OpenSSH installations which have GSSAPI enabled, this flaw could allow a user who sucessfully authenticates using a method other than GSSAPI to be delegated with GSSAPI credentials. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2798 to this issue. Additionally, the following bugs have been addressed: The ssh command incorrectly failed when it was issued by the root user with a non-default group set. The sshd daemon could fail to properly close the client connection if multiple X clients were forwarded over the connection and the client session exited. The sshd daemon could bind only on the IPv6 address script_family( for X forwarding if the port on IPv4 address script_family( was already bound. The X forwarding did not work in such cases. This update also adds support for recording login user IDs for the auditing service. The user ID is attached to the audit records generated from the user's session. All users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2005-527.html Risk factor : Medium CVSS Score: 5.0
Referencia Cruzada:	BugTraq ID: 14729 Common Vulnerability Exposure (CVE) ID: CVE-2005-2798 1014845 http://securitytracker.com/id?1014845 14729 http://www.securityfocus.com/bid/14729 16686 http://secunia.com/advisories/16686 17077 http://secunia.com/advisories/17077 17245 http://secunia.com/advisories/17245 18010 http://secunia.com/advisories/18010 18406 http://secunia.com/advisories/18406 18507 http://secunia.com/advisories/18507 18661 http://secunia.com/advisories/18661 18717 http://secunia.com/advisories/18717 19141 http://www.osvdb.org/19141 ADV-2006-0144 http://www.vupen.com/english/advisories/2006/0144 HPSBUX02090 http://www.securityfocus.com/archive/1/421411/100/0/threaded MDKSA-2005:172 http://www.mandriva.com/security/advisories?name=MDKSA-2005:172 RHSA-2005:527 http://www.redhat.com/support/errata/RHSA-2005-527.html SCOSA-2005.53 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt SSRT051058 SUSE-SR:2006:003 http://lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html USN-209-1 https://usn.ubuntu.com/209-1/ [openssh-unix-announce] 20050901 Announce: OpenSSH 4.2 released http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html hpux-secure-shell-dos(24064) https://exchange.xforce.ibmcloud.com/vulnerabilities/24064 http://support.avaya.com/elmodocs2/security/ASA-2006-016.htm http://support.avaya.com/elmodocs2/security/ASA-2006-033.htm oval:org.mitre.oval:def:1345 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1345 oval:org.mitre.oval:def:1566 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1566 oval:org.mitre.oval:def:9717 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9717
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.