Test ID:	1.3.6.1.4.1.25623.1.0.60677
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-597-1 (openssh)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to openssh announced via advisory USN-597-1. A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. Details follow: Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address script_family(. A local attacker could exploit this flaw on systems with IPv6 enabled to hijack connections, including X11 forwards. Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: openssh-client 1:4.2p1-7ubuntu3.3 Ubuntu 6.10: openssh-client 1:4.3p2-5ubuntu1.2 Ubuntu 7.04: openssh-client 1:4.3p2-8ubuntu1.2 Ubuntu 7.10: openssh-client 1:4.6p1-5ubuntu0.2 In general, a standard system upgrade is sufficient to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-597-1 Risk factor : High CVSS Score: 6.9
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-1483 http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html BugTraq ID: 28444 http://www.securityfocus.com/bid/28444 Bugtraq: 20080325 rPSA-2008-0120-1 gnome-ssh-askpass openssh openssh-client openssh-server (Google Search) http://www.securityfocus.com/archive/1/490054/100/0/threaded Cert/CC Advisory: TA08-260A http://www.us-cert.gov/cas/techalerts/TA08-260A.html Cisco Security Advisory: 20130220 OpenSSH Forwarded X Connection Session Hijack Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2008-1483 Debian Security Information: DSA-1576 (Google Search) http://www.debian.org/security/2008/dsa-1576 FreeBSD Security Advisory: FreeBSD-SA-08:05 http://security.FreeBSD.org/advisories/FreeBSD-SA-08:05.openssh.asc http://www.gentoo.org/security/en/glsa/glsa-200804-03.xml HPdes Security Advisory: HPSBUX02337 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01462841 HPdes Security Advisory: SSRT080072 http://www.mandriva.com/security/advisories?name=MDVSA-2008:078 http://www.globus.org/mail_archive/security-announce/2008/04/msg00000.html NETBSD Security Advisory: NetBSD-SA2008-005 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-005.txt.asc https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6085 http://www.securitytracker.com/id?1019707 http://secunia.com/advisories/29522 http://secunia.com/advisories/29537 http://secunia.com/advisories/29554 http://secunia.com/advisories/29626 http://secunia.com/advisories/29676 http://secunia.com/advisories/29683 http://secunia.com/advisories/29686 http://secunia.com/advisories/29721 http://secunia.com/advisories/29735 http://secunia.com/advisories/29873 http://secunia.com/advisories/29939 http://secunia.com/advisories/30086 http://secunia.com/advisories/30230 http://secunia.com/advisories/30249 http://secunia.com/advisories/30347 http://secunia.com/advisories/30361 http://secunia.com/advisories/31531 http://secunia.com/advisories/31882 http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.540188 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019235.1-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-237444-1 SuSE Security Announcement: SUSE-SR:2008:009 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00007.html https://usn.ubuntu.com/597-1/ http://www.vupen.com/english/advisories/2008/0994/references http://www.vupen.com/english/advisories/2008/1123/references http://www.vupen.com/english/advisories/2008/1124/references http://www.vupen.com/english/advisories/2008/1448/references http://www.vupen.com/english/advisories/2008/1526/references http://www.vupen.com/english/advisories/2008/1624/references http://www.vupen.com/english/advisories/2008/1630/references http://www.vupen.com/english/advisories/2008/2396 http://www.vupen.com/english/advisories/2008/2584 XForce ISS Database: openssh-sshd-session-hijacking(41438) https://exchange.xforce.ibmcloud.com/vulnerabilities/41438
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.