PT-2006-7550 · Debian · Lsh-Utils-Doc+4
Stefan Pfetzing
·
Publicado
1970-01-01
·
Atualizado
2017-07-20
·
CVE-2006-0353
CVSS v2.0
3.6
Baixa
| Vetor | AV:L/AC:L/Au:N/C:P/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
lsh-server versions 2.0.1 and earlier
lsh-client versions 2.0.1 and earlier
lsh-utils versions 2.0.1 and earlier
lsh-utils-doc versions 2.0.1 and earlier
Description
The issue concerns multiple vulnerabilities in the lsh package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality and availability of protected information. These vulnerabilities can be exploited by a local attacker. Specifically, in lshd for lsh 2.0.1, the unix random.c file leaks file descriptors related to the randomness generator. This allows local users to cause a denial of service by truncating the seed file, preventing the server from starting, or obtain sensitive seed information that could be used to crack keys.
Recommendations
For lsh-server version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk.
For lsh-client version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk.
For lsh-utils version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk.
For lsh-utils-doc version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to the
unix random.c file to minimize the risk of exploitation.Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Lsh-Client
Lsh-Server
Lsh-Utils
Lsh-Utils-Doc