English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 76783 CVE descriptions
and 40246 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.51459
Category:Conectiva Local Security Checks
Title:Conectiva Security Advisory CLA-2003:741
Summary:Conectiva Security Advisory CLA-2003:741
Description:
The remote host is missing updates announced in
advisory CLA-2003:741.

OpenSSH[1] is a very popular and versatile tool that uses encrypted
connections between hosts and is commonly used for remote
administration.

This update fixes new vulnerabilities found in the code that handles
buffers in OpenSSH. These vulnerabilities are similiar to the ones
fixed in the CLSA-2003:739 announcement[2] (CVE-2003-0693) and can be
exploited by a remote attacker to cause a denial of service condition
and potentially execute arbitrary code (although there is still no
concrete evidence of that).

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2003-0695 to this additional issue[3].

The OpenSSH team released the version 3.7.1 which fixes this
vulnerability[4]. This update contains the versions originally
distributed with Conectiva Linux added of backported patches.

Additionally, patches made by Solar Designer to fix memory bugs in
other parts of the code are being added. Althought it is unlikely
that these bugs are exploitable, they are being treatead as security
fixes by now and have the name CVE-2003-0682 assigned[5] by The
Common Vulnerabilities and Exposures project (cve.mitre.org).


Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'

http://www.openssh.org
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000739&idioma=en
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0695
http://www.openssh.com/txt/buffer.adv
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0682
http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:741
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003

Risk factor : Critical
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2003-0693
Bugtraq: 20030916 OpenSSH Buffer Management Bug Advisory (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106373247528528&w=2
http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010135.html
http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010146.html
http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010103.html
RedHat Security Advisories: RHSA-2003:279
http://marc.theaimsgroup.com/?l=bugtraq&m=106373546332230&w=2
http://www.redhat.com/support/errata/RHSA-2003-280.html
http://www.mandriva.com/security/advisories?name=MDKSA-2003:090
Debian Security Information: DSA-382 (Google Search)
http://www.debian.org/security/2003/dsa-382
Debian Security Information: DSA-383 (Google Search)
http://www.debian.org/security/2003/dsa-383
FreeBSD Security Advisory: FreeBSD-SA-03:12
En Garde Linux Advisory: ESA-20030916-023
Immunix Linux Advisory: IMNX-2003-7+-020-01
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000620.1-1
SuSE Security Announcement: SuSE-SA:2003:038 (Google Search)
SuSE Security Announcement: SuSE-SA:2003:039 (Google Search)
Bugtraq: 20030916 [slackware-security] OpenSSH Security Advisory (SSA:2003-259-01) (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106374466212309&w=2
Bugtraq: 20030917 [OpenPKG-SA-2003.040] OpenPKG Security Advisory (openssh) (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106381409220492&w=2
http://marc.theaimsgroup.com/?l=bugtraq&m=106381396120332&w=2
http://www.cert.org/advisories/CA-2003-24.html
CERT/CC vulnerability note: VU#333628
http://www.kb.cert.org/vuls/id/333628
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2719
XForce ISS Database: openssh-packet-bo(13191)
http://xforce.iss.net/xforce/xfdb/13191
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:447
Common Vulnerability Exposure (CVE) ID: CVE-2003-0695
http://marc.theaimsgroup.com/?l=openbsd-security-announce&m=106375582924840
En Garde Linux Advisory: ESA-20030918-024
Conectiva Linux advisory: CLA-2003:741
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000741
Bugtraq: 20030917 [slackware-security] OpenSSH updated again (SSA:2003-260-01) (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106382542403716&w=2
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:452
Common Vulnerability Exposure (CVE) ID: CVE-2003-0682
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:446
CopyrightCopyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 40246 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.