Test ID:	1.3.6.1.4.1.25623.1.0.902488
Category:	General
Title:	OpenSSH 'sshd' GSSAPI Credential Disclosure Vulnerability
Summary:	The host is running OpenSSH sshd with GSSAPI enabled and is prone; to credential disclosure vulnerability.
Description:	Summary: The host is running OpenSSH sshd with GSSAPI enabled and is prone to credential disclosure vulnerability. Vulnerability Insight: The flaw is due to an error in handling GSSAPI credential delegation, Which allow GSSAPI credentials to be delegated to users who log in with methods other than GSSAPI authentication (e.g. public key) when the client requests it. Vulnerability Impact: Successful exploitation could allows remote attackers to bypass security restrictions and gain escalated privileges. Affected Software/OS: OpenSSH version prior to 4.2. Solution: Upgrade OpenSSH to 4.2 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	BugTraq ID: 14729 Common Vulnerability Exposure (CVE) ID: CVE-2005-2798 http://www.securityfocus.com/bid/14729 HPdes Security Advisory: HPSBUX02090 http://www.securityfocus.com/archive/1/421411/100/0/threaded HPdes Security Advisory: SSRT051058 http://www.mandriva.com/security/advisories?name=MDKSA-2005:172 http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html http://www.osvdb.org/19141 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1345 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1566 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9717 http://www.redhat.com/support/errata/RHSA-2005-527.html SCO Security Bulletin: SCOSA-2005.53 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt http://securitytracker.com/id?1014845 http://secunia.com/advisories/16686 http://secunia.com/advisories/17077 http://secunia.com/advisories/17245 http://secunia.com/advisories/18010 http://secunia.com/advisories/18406 http://secunia.com/advisories/18507 http://secunia.com/advisories/18661 http://secunia.com/advisories/18717 SuSE Security Announcement: SUSE-SR:2006:003 (Google Search) http://lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html https://usn.ubuntu.com/209-1/ http://www.vupen.com/english/advisories/2006/0144 XForce ISS Database: hpux-secure-shell-dos(24064) https://exchange.xforce.ibmcloud.com/vulnerabilities/24064
Copyright	Copyright (C) 2011 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.