Test ID:	1.3.6.1.4.1.25623.1.0.123172
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2015-0425)
Summary:	The remote host is missing an update for the 'openssh' package(s) announced via the ELSA-2015-0425 advisory.
Description:	Summary: The remote host is missing an update for the 'openssh' package(s) announced via the ELSA-2015-0425 advisory. Vulnerability Insight: [6.6.1p1-11 + 0.9.3-9] - fix direction in CRYPTO_SESSION audit message (#1171248) [6.6.1p1-10 + 0.9.3-9] - add new option GSSAPIEnablek5users and disable using ~ /.k5users by default CVE-2014-9278 (#1169843) [6.6.1p1-9 + 0.9.3-9] - log via monitor in chroots without /dev/log (#1083482) [6.6.1p1-8 + 0.9.3-9] - increase size of AUDIT_LOG_SIZE to 256 (#1171163) - record pfs= field in CRYPTO_SESSION audit event (#1171248) [6.6.1p1-7 + 0.9.3-9] - fix gsskex patch to correctly handle MONITOR_REQ_GSSSIGN request (#1118005) [6.6.1p1-6 + 0.9.3-9] - correct the calculation of bytes for authctxt->krb5_ccname (#1161073)[6.6.1p1-5 + 0.9.3-9]- change audit trail for unknown users (#1158521)[6.6.1p1-4 + 0.9.3-9]- revert the default of KerberosUseKuserok back to yes- fix kuserok patch which checked for the existence of .k5login unconditionally and hence prevented other mechanisms to be used properly[6.6.1p1-3 + 0.9.3-9]- fix parsing empty options in sshd_conf- ignore SIGXFSZ in postauth monitor[6.6.1p1-2 + 0.9.3-9]- slightly change systemd units logic - use sshd-keygen.service (#1066615)- log when a client requests an interactive session and only sftp is allowed (#1130198)- sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode (#1143867)[6.6.1p1-1 + 0.9.3-9]- new upstream release (#1059667)- prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)- make /etc/ssh/moduli file public (#1134448)- test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service- don't clean up gssapi credentials by default (#1134447)- ssh-agent - try CLOCK_BOOTTIME with fallback (#1134449)- disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6- add support for ED25519 keys to sshd-keygen and sshd.sysconfig- standardise on NI_MAXHOST for gethostname() string lengths (#1097665)- set a client's address right after a connection is set (mindrot#2257) (#912792)- apply RFC3454 stringprep to banners when possible (mindrot#2058) (#1104662)- don't consider a partial success as a failure (mindrot#2270) (#1112972) Affected Software/OS: 'openssh' package(s) on Oracle Linux 7. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2653 BugTraq ID: 66459 http://www.securityfocus.com/bid/66459 Debian Security Information: DSA-2894 (Google Search) http://www.debian.org/security/2014/dsa-2894 http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html HPdes Security Advisory: HPSBUX03188 http://marc.info/?l=bugtraq&m=141576985122836&w=2 HPdes Security Advisory: SSRT101487 http://www.mandriva.com/security/advisories?name=MDVSA-2014:068 http://www.mandriva.com/security/advisories?name=MDVSA-2015:095 http://openwall.com/lists/oss-security/2014/03/26/7 RedHat Security Advisories: RHSA-2014:1552 http://rhn.redhat.com/errata/RHSA-2014-1552.html RedHat Security Advisories: RHSA-2015:0425 http://rhn.redhat.com/errata/RHSA-2015-0425.html http://secunia.com/advisories/59855 http://www.ubuntu.com/usn/USN-2164-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-9278 71420 http://www.securityfocus.com/bid/71420 RHSA-2015:0425 [oss-security] 20141202 CVE request: OpenSSH ~/.k5users patch (Fedora and downstreams) http://www.openwall.com/lists/oss-security/2014/12/02/3 [oss-security] 20141204 Re: CVE request: OpenSSH ~/.k5users patch (Fedora and downstreams) http://www.openwall.com/lists/oss-security/2014/12/04/17 http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855 https://bugzilla.mindrot.org/show_bug.cgi?id=1867 https://bugzilla.redhat.com/show_bug.cgi?id=1169843 openssh-gssservkrb5-sec-bypass(99090) https://exchange.xforce.ibmcloud.com/vulnerabilities/99090
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.