Rapid7 VulnDB

RHSA-2013:1591: openssh security, bug fix, and enhancement update

Back to Search

RHSA-2013:1591: openssh security, bug fix, and enhancement update

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Published
03/07/2013
Created
07/25/2018
Added
11/21/2013
Modified
07/04/2017

Description

OpenSSH is OpenBSD's Secure Shell (SSH) protocol implementation.These packages include the core files necessary for the OpenSSH clientand server.The default OpenSSH configuration made it easy for remote attackers toexhaust unauthorized connection slots and prevent other users from beingable to log in to a system. This flaw has been addressed by enabling randomearly connection drops by setting MaxStartups to 10:30:100 by default.For more information, refer to the sshd_config(5) man page. (CVE-2010-5107)These updated openssh packages include numerous bug fixes and enhancements.Space precludes documenting all of these changes in this advisory.Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes,linked to in the References, for information on the most significant ofthese changes.All openssh users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues and addthese enhancements.

Solution(s)

  • redhat-upgrade-openssh
  • redhat-upgrade-openssh-askpass
  • redhat-upgrade-openssh-clients
  • redhat-upgrade-openssh-debuginfo
  • redhat-upgrade-openssh-ldap
  • redhat-upgrade-openssh-server
  • redhat-upgrade-pam_ssh_agent_auth

References

  • redhat-upgrade-openssh
  • redhat-upgrade-openssh-askpass
  • redhat-upgrade-openssh-clients
  • redhat-upgrade-openssh-debuginfo
  • redhat-upgrade-openssh-ldap
  • redhat-upgrade-openssh-server
  • redhat-upgrade-pam_ssh_agent_auth

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;