Test ID:	1.3.6.1.4.1.25623.1.0.51243
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2002:131
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory RHSA-2002:131. Updated openssh packages are now available for Red Hat Linux Advanced Server. These updates fix an input validation error in OpenSSH. OpenSSH provides an implementation of the SSH (secure shell) protocol used for logging into and executing commands on remote machines. Versions of the OpenSSH server between 2.3.1 and 3.3 contain an input validation error that can result in an integer overflow and privilege escalation. At this time, Red Hat does not believe that the default installation of OpenSSH on Red Hat Linux is vulnerable to this issue however a user would be vulnerable if the configuration option 'PAMAuthenticationViaKbdInt' is enabled in the sshd configuration file (it is not enabled by default). We have applied the security fix provided by the OpenSSH team to these errata packages which are based on OpenSSH 3.1p1. This should minimize the impact of upgrading to our errata packages. All users of OpenSSH should update to these errata packages which are not vulnerable to this issue. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2002-131.html http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=102510268109227 http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=102511867031136 Risk factor : Critical CVSS Score: 10.0
Cross-Ref:	BugTraq ID: 5093 Common Vulnerability Exposure (CVE) ID: CVE-2002-0640 http://www.securityfocus.com/bid/5093 Bugtraq: 20020626 OpenSSH Security Advisory (adv.iss) (Google Search) http://marc.info/?l=bugtraq&m=102514371522793&w=2 Bugtraq: 20020626 Revised OpenSSH Security Advisory (adv.iss) (Google Search) http://marc.info/?l=bugtraq&m=102514631524575&w=2 Bugtraq: 20020627 How to reproduce OpenSSH Overflow. (Google Search) http://marc.info/?l=bugtraq&m=102521542826833&w=2 Bugtraq: 20020628 Sun statement on the OpenSSH Remote Challenge Vulnerability (Google Search) http://marc.info/?l=bugtraq&m=102532054613894&w=2 Caldera Security Advisory: CSSA-2002-030.0 ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt http://www.cert.org/advisories/CA-2002-18.html CERT/CC vulnerability note: VU#369347 http://www.kb.cert.org/vuls/id/369347 Conectiva Linux advisory: CLA-2002:502 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502 Debian Security Information: DSA-134 (Google Search) http://www.debian.org/security/2002/dsa-134 En Garde Linux Advisory: ESA-20020702-016 http://www.linuxsecurity.com/advisories/other_advisory-2177.html HPdes Security Advisory: HPSBUX0206-195 http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195 http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:040 http://www.osvdb.org/839 http://www.redhat.com/support/errata/RHSA-2002-127.html http://www.redhat.com/support/errata/RHSA-2002-131.html SuSE Security Announcement: SuSE-SA:2002:024 (Google Search) http://www.novell.com/linux/security/advisories/2002_024_openssh_txt.html
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.