漏洞信息详情
OpenSSH sshd 权限许可和访问控制问题漏洞
- CNNVD编号:CNNVD-201508-001
- 危害等级: 中危
- CVE编号: CVE-2015-5600
- 漏洞类型: 权限许可和访问控制问题
- 发布时间: 2015-08-03
- 威胁类型: 远程
- 更新时间: 2021-11-08
- 厂 商: openbsd
- 漏洞来源:
漏洞简介
OpenSSH(OpenBSD Secure Shell)是OpenBSD计划组所维护的一套用于安全访问远程计算机的连接工具。该工具是SSH协议的开源实现,支持对所有的传输进行加密,可有效阻止窃听、连接劫持以及其他网络级的攻击。
OpenSSH 6.9及之前版本的sshd中的auth2-chall.c文件中的‘kbdint_next_device’函数存在安全漏洞,该漏洞源于程序没有正确限制处理单链接中的keyboard-interactive设备。远程攻击者可借助ssh -oKbdInteractiveDevices选项中较长且重复的列表利用该漏洞实施暴力破解攻击,或造成拒绝服务(CPU消耗)。
漏洞公告
目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c
参考网址
来源:CONFIRM
链接:http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c
来源:CONFIRM
链接:https://support.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/kb/HT205031
来源:CONFIRM
链接:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128992
来源:SECTRACK
链接:http://www.securitytracker.com/id/1032988
来源:CONFIRM
链接:https://kc.mcafee.com/corporate/index?page=content&id=SB10157
来源:CONFIRM
链接:https://security.netapp.com/advisory/ntap-20151106-0001/
来源:CONFIRM
链接:https://kc.mcafee.com/corporate/index?page=content&id=SB10136
来源:CONFIRM
链接:http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.HTML
来源:CONFIRM
链接:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952480
来源:FEDORA
链接:http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162955.HTML
来源:CONFIRM
链接:http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.HTML
来源:CONFIRM
链接:http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h
来源:CONFIRM
链接:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
来源:CONFIRM
链接:http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.HTML
来源:FULLDISC
链接:http://seclists.org/fulldisclosure/2015/Jul/92
来源:MLIST
链接:https://lists.debian.org/debian-lts-announce/2018/09/msg00010.HTML
来源:MLIST
链接:http://openwall.com/lists/oss-security/2015/07/23/4
来源:UBUNTU
链接:http://www.ubuntu.com/usn/USN-2710-2
来源:UBUNTU
链接:http://www.ubuntu.com/usn/USN-2710-1
来源:GENTOO
链接:https://security.gentoo.org/glsa/201512-04
来源:BID
链接:https://www.securityfocus.com/bid/91787
来源:REDHAT
链接:http://rhn.redhat.com/errata/RHSA-2016-0466.HTML
来源:MISC
链接:https://www.arista.com/en/support/advisories-notices/security-advisories/1174-security-advisory-12
来源:CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple
链接:http://lists.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/archives/security-announce/2015/Aug/msg00001.HTML
来源:BID
链接:https://www.securityfocus.com/bid/75990
来源:CONFIRM
链接:http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.HTML
来源:FEDORA
链接:http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165170.HTML
来源:BID
链接:https://www.securityfocus.com/bid/92012
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.HTML
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.HTML
来源:CONFIRM
链接:http://kb.juniper.net/InfoCenter/index?page=content&id=jsA10697
来源:SUSE
链接:http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.HTML
受影响实体
- Openbsd Openssh:6.9
补丁
- auth2-chall
评论