Test ID:	1.3.6.1.4.1.25623.1.0.122921
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2016-3531)
Summary:	The remote host is missing an update for the 'openssh' package(s) announced via the ELSA-2016-3531 advisory.
Description:	Summary: The remote host is missing an update for the 'openssh' package(s) announced via the ELSA-2016-3531 advisory. Vulnerability Insight: [4.3p2-82.0.2] - CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices (John Haxby) [orabug 22985024] - CVE-2016-3115: missing sanitisation of input for X11 forwarding (John Haxby) [orabug 22985024] Affected Software/OS: 'openssh' package(s) on Oracle Linux 5. Solution: Please install the updated package(s). CVSS Score: 8.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5600 http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html BugTraq ID: 75990 http://www.securityfocus.com/bid/75990 BugTraq ID: 91787 http://www.securityfocus.com/bid/91787 BugTraq ID: 92012 http://www.securityfocus.com/bid/92012 http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.html http://seclists.org/fulldisclosure/2015/Jul/92 https://security.gentoo.org/glsa/201512-04 https://www.arista.com/en/support/advisories-notices/security-advisories/1174-security-advisory-12 https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html http://openwall.com/lists/oss-security/2015/07/23/4 RedHat Security Advisories: RHSA-2016:0466 http://rhn.redhat.com/errata/RHSA-2016-0466.html http://www.securitytracker.com/id/1032988 SuSE Security Announcement: SUSE-SU-2015:1581 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html http://www.ubuntu.com/usn/USN-2710-1 http://www.ubuntu.com/usn/USN-2710-2 Common Vulnerability Exposure (CVE) ID: CVE-2016-3115 BugTraq ID: 84314 http://www.securityfocus.com/bid/84314 https://www.exploit-db.com/exploits/39569/ http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184264.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179924.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183122.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178838.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180491.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183101.html FreeBSD Security Advisory: FreeBSD-SA-16:14 https://www.freebsd.org/security/advisories/FreeBSD-SA-16:14.openssh.asc http://seclists.org/fulldisclosure/2016/Mar/46 http://seclists.org/fulldisclosure/2016/Mar/47 https://security.gentoo.org/glsa/201612-18 http://packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 RedHat Security Advisories: RHSA-2016:0465 http://rhn.redhat.com/errata/RHSA-2016-0465.html http://www.securitytracker.com/id/1035249
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.