My system is located on a network which is scanned periodically for security problems. A recent scan has detected 3 issues with OpenSSH on my system. They are:
OpenSSH Post-authentication sshd Memory Corruption Vulnerability with AES-GCM cipher, CVE-2013-4548
OpenSSH Wildcards on AcceptEnv Vulnerability, CVE-2014-2532
OpenSSH SSHFP DNS resource record look up bypass in the client, CVE-2014-2653
The suggested solution to the problem is to upgrade to OpenSSH version 6.7p1 or later.
I see, looking at the OpenSSH website that the current version is 7.1. How hard is it to upgrade OpenSSH on my version of opensuse? If I do upgrade OpenSSH, what will happen when the automatic update attempts to update OpenSSH?
I assume that it was tested for vulnerabilities–as it was all done from the outside w/o logging in and with attempts to exploit the system. The version of OpenSSH is shown below (output of the zypper command):
Information for package openssh:
Repository: openSUSE-13.1-Update
Name: openssh
Version: 6.2p2-3.4.1
Arch: x86_64
Vendor: openSUSE
Installed: Yes
Status: up-to-date
Installed Size: 3.0 MiB
Summary: Secure Shell Client and Server (Remote Login Program)
Description:
SSH (Secure Shell) is a program for logging into and executing commands
on a remote machine. It is intended to replace rsh (rlogin and rsh) and
provides openssl (secure encrypted communication) between two untrusted
hosts over an insecure network.
So, I do thinik I need to install a newer version of OpenSSH. I am not sure exactly how to do this and then keep everything working when opensuse does automatic updates of OpenSSH and other software.
I am running 13.1 because I have been told that it will be maintained for a longer time than the intermediate updates, e.g. 13.2 …
I assumed that I have been using the most current repository and that the appropriate updates would have been made. As in my previous reply, I am not running 6.6p1. I am using the standard repositories that were set up when I installed the system with a few extras. See below:
Most scanners are dumb and never test actual vulnerabilities - they just compare identification strings. Read changelog of your openssh package and see for yourself that the first CVE is fixed there. If you have reasons to not believe it, open bug report.
I see. I am not familiar with the SSH login protocol. From your comment, I am inferring that the server sends some sort of ID string to the client attempting to log in that identifies the communication software (openssh) and the software version number. I didn’t realize that.
I would believe that this scanner is dumb and I have no reason to doubt that the vulnerability has been fixed.
I just need to figure out how to pass the scan so my system quits getting flagged. It seems that I should update openssh but I don’t have a sense for how big a job that is to keep everything working going forward.
malcolmlewis;2731402 Wrote:
> Hi
> I would suggest raising a bug to confirm if/when the missing two
> are/where fixed or even applicable (since it may not be vulnerable)
> openSUSE:Submitting bug reports - openSUSE Wiki
>
> What you are seeing is common with scanners that just check the
> version…
I will take your advice and give this a try. Thanks.
Hi
When done, can you post back the bug number
–
Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
SUSE Linux Enterprise Desktop 12 | GNOME 3.10.1 | 3.12.44-52.18-default
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!
I have looked up all three security issues in Bugzilla and they all appear to have been fixed. The specific faults are noted and are noted as “fixed”.
I am not really familiar with Bugzilla so it is hard for me to understand which is the appropriate version of OpenSSH to use or even where to get it. I did look up the bugs in the opensuse 13.1 bugzilla database and this is where the bugs are stated as being fixed. So, it seems like the bugs are fixed in 13.1. I am not sure exactly what to do… I have been updating my system from the opensuse 13.1 repository, so I would think that I should somehow have access to the newer versions of OpenSSH.
Do you have some suggestions as to what I should do?
