ID de Prueba:	1.3.6.1.4.1.25623.1.0.64802
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2009:1287
Resumen:	The remote host is missing updates announced in;advisory RHSA-2009:1287.;;OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These;packages include the core files necessary for both the OpenSSH client and;server.;;A flaw was found in the SSH protocol. An attacker able to perform a;man-in-the-middle attack may be able to obtain a portion of plain text from;an arbitrary ciphertext block when a CBC mode cipher was used to encrypt;SSH communication. This update helps mitigate this attack: OpenSSH clients;and servers now prefer CTR mode ciphers to CBC mode, and the OpenSSH server;now reads SSH packets up to their full possible length when corruption is;detected, rather than reporting errors early, reducing the possibility of;successful plain text recovery. (CVE-2008-5161)
Descripción:	Summary: The remote host is missing updates announced in advisory RHSA-2009:1287. OpenSSH is OpenBSD's SSH (Secure Shell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server. A flaw was found in the SSH protocol. An attacker able to perform a man-in-the-middle attack may be able to obtain a portion of plain text from an arbitrary ciphertext block when a CBC mode cipher was used to encrypt SSH communication. This update helps mitigate this attack: OpenSSH clients and servers now prefer CTR mode ciphers to CBC mode, and the OpenSSH server now reads SSH packets up to their full possible length when corruption is detected, rather than reporting errors early, reducing the possibility of successful plain text recovery. (CVE-2008-5161) Solution: All OpenSSH users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues and add these enhancements. After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically. Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date CVSS Score: 2.6 CVSS Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-5161 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html BugTraq ID: 32319 http://www.securityfocus.com/bid/32319 Bugtraq: 20081121 OpenSSH security advisory: cbc.adv (Google Search) http://www.securityfocus.com/archive/1/498558/100/0/threaded Bugtraq: 20081123 Revised: OpenSSH security advisory: cbc.adv (Google Search) http://www.securityfocus.com/archive/1/498579/100/0/threaded CERT/CC vulnerability note: VU#958563 http://www.kb.cert.org/vuls/id/958563 HPdes Security Advisory: HPSBMA02447 http://marc.info/?l=bugtraq&m=125017764422557&w=2 HPdes Security Advisory: SSRT090062 http://isc.sans.org/diary.html?storyid=5366 http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt http://osvdb.org/49872 http://osvdb.org/50035 http://osvdb.org/50036 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279 RedHat Security Advisories: RHSA-2009:1287 http://rhn.redhat.com/errata/RHSA-2009-1287.html http://www.securitytracker.com/id?1021235 http://www.securitytracker.com/id?1021236 http://www.securitytracker.com/id?1021382 http://secunia.com/advisories/32740 http://secunia.com/advisories/32760 http://secunia.com/advisories/32833 http://secunia.com/advisories/33121 http://secunia.com/advisories/33308 http://secunia.com/advisories/34857 http://secunia.com/advisories/36558 http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1 http://www.vupen.com/english/advisories/2008/3172 http://www.vupen.com/english/advisories/2008/3173 http://www.vupen.com/english/advisories/2008/3409 http://www.vupen.com/english/advisories/2009/1135 http://www.vupen.com/english/advisories/2009/3184 XForce ISS Database: openssh-sshtectia-cbc-info-disclosure(46620) https://exchange.xforce.ibmcloud.com/vulnerabilities/46620
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.