Test ID:	1.3.6.1.4.1.25623.1.0.52635
Category:	FreeBSD Local Security Checks
Title:	FreeBSD Security Advisory (FreeBSD-SA-03:12.openssh.asc)
Summary:	The remote host is missing an update to the system; as announced in the referenced advisory FreeBSD-SA-03:12.openssh.asc
Description:	Summary: The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-03:12.openssh.asc Vulnerability Insight: OpenSSH is a free version of the SSH protocol suite of network connectivity tools. OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other network-level attacks. Additionally, OpenSSH provides a myriad of secure tunneling capabilities, as well as a variety of authentication methods. `ssh' is the client application, while `sshd' is the server. Several operations within OpenSSH require dynamic memory allocation or reallocation. Examples are: the receipt of a packet larger than available space in a currently allocated buffer. Creation of additional channels beyond the currently allocated maximum, and allocation of new sockets beyond the currently allocated maximum. Many of these operations can fail either due to `out of memory' or due to explicit checks for ridiculously sized requests. However, the failure occurs after the allocation size has already been updated, so that the bookkeeping data structures are in an inconsistent state (the recorded size is larger than the actual allocation). Furthermore, the detection of these failures causes OpenSSH to invoke several `fatal_cleanup' handlers, some of which may then attempt to use these inconsistent data structures. For example, a handler may zero and free a buffer in this state, and as a result memory outside of the allocated area will be overwritten with NUL bytes. Solution: Upgrade your system to the appropriate stable release or security branch dated after the correction date. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0693 Bugtraq: 20030916 OpenSSH Buffer Management Bug Advisory (Google Search) http://marc.info/?l=bugtraq&m=106373247528528&w=2 Bugtraq: 20030916 [slackware-security] OpenSSH Security Advisory (SSA:2003-259-01) (Google Search) http://marc.info/?l=bugtraq&m=106374466212309&w=2 Bugtraq: 20030917 [OpenPKG-SA-2003.040] OpenPKG Security Advisory (openssh) (Google Search) http://marc.info/?l=bugtraq&m=106381409220492&w=2 http://www.cert.org/advisories/CA-2003-24.html CERT/CC vulnerability note: VU#333628 http://www.kb.cert.org/vuls/id/333628 Debian Security Information: DSA-382 (Google Search) http://www.debian.org/security/2003/dsa-382 Debian Security Information: DSA-383 (Google Search) http://www.debian.org/security/2003/dsa-383 En Garde Linux Advisory: ESA-20030916-023 FreeBSD Security Advisory: FreeBSD-SA-03:12 http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010103.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010135.html http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010146.html Immunix Linux Advisory: IMNX-2003-7+-020-01 http://www.mandriva.com/security/advisories?name=MDKSA-2003:090 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2719 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A447 RedHat Security Advisories: RHSA-2003:279 http://marc.info/?l=bugtraq&m=106373546332230&w=2 http://www.redhat.com/support/errata/RHSA-2003-280.html http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000620.1-1 SuSE Security Announcement: SuSE-SA:2003:038 (Google Search) SuSE Security Announcement: SuSE-SA:2003:039 (Google Search) http://marc.info/?l=bugtraq&m=106381396120332&w=2 XForce ISS Database: openssh-packet-bo(13191) https://exchange.xforce.ibmcloud.com/vulnerabilities/13191
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.