Test ID:	1.3.6.1.4.1.25623.1.0.52990
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2005:481
Summary:	Redhat Security Advisory RHSA-2005:481
Description:	The remote host is missing updates announced in advisory RHSA-2005:481. OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. SSH replaces rlogin and rsh, and provides secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over a secure channel. Public key authentication can be used for passwordless access to servers. The scp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses scp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue. These updated packages also correct the following bug: On systems in which direct ssh access for the root user was disabled by configuration (setting PermitRootLogin no), attempts to guess the root password could be judged as sucessful or unsucessful by observing a delay. Users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2005-481.html Risk factor : Medium
Cross-Ref:	BugTraq ID: 9986 Common Vulnerability Exposure (CVE) ID: CVE-2004-0175 Conectiva Linux advisory: CLSA-2004:831 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000831 http://www.mandriva.com/security/advisories?name=MDKSA-2005:100 http://www.mandriva.com/security/advisories?name=MDVSA-2008:191 http://www.redhat.com/support/errata/RHSA-2005-106.html http://www.redhat.com/support/errata/RHSA-2005-074.html http://www.redhat.com/support/errata/RHSA-2005-165.html http://www.redhat.com/support/errata/RHSA-2005-481.html http://www.redhat.com/support/errata/RHSA-2005-495.html http://www.redhat.com/support/errata/RHSA-2005-562.html http://www.redhat.com/support/errata/RHSA-2005-567.html SCO Security Bulletin: SCOSA-2006.11 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt SuSE Security Announcement: SuSE-SA:2004:009 (Google Search) http://www.novell.com/linux/security/advisories/2004_09_kernel.html Computer Incident Advisory Center Bulletin: O-212 http://www.ciac.org/ciac/bulletins/o-212.shtml http://www.securityfocus.com/bid/9986 http://www.osvdb.org/9550 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10184 http://secunia.com/advisories/19243 http://secunia.com/advisories/17135 XForce ISS Database: openssh-scp-file-overwrite(16323) http://xforce.iss.net/xforce/xfdb/16323
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: