PT-2018-2784 · Openssh+3 · Openssh+3

Publicado 2018-08-28 · Atualizado 2025-11-04 · CVE-2018-15919

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions through 7.8

Description The issue is related to the auth-gss2.c file in OpenSSH, which lacks protection of service data. This could allow a remote attacker to disclose protected information. Additionally, remotely observable behavior in auth-gss2.c could be used by remote attackers to detect the existence of users on a target system when GSS2 is in use.

Recommendations For OpenSSH versions through 7.8, consider disabling the GSS2 authentication mechanism as a temporary workaround until a patch is available. Restrict access to the auth-gss2.c module to minimize the risk of exploitation. Avoid using the GSS2 authentication mechanism in the affected OpenSSH versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2018-2598

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2019-01833

CVE-2018-15919

ECHO-765E-25A4-4A31

OPENSUSE-SU-2018_3801-1

Produtos afetados

Alt Linux

Debian

Openssh

Suse

Referências · 16

• https://cve.org/CVERecord?id=CVE-2018-15919 · Nota de Segurança
• https://kc.mcafee.com/corporate/index?page=content&id=SB10269&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_GB · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10269&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_GB · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-15919 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-15919 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20181221-0001 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15919 · Nota de Segurança
• http://openwall.com/lists/oss-security/2018/08/27/2 · Nota
• http://securityfocus.com/bid/105163 · Nota
• https://reddit.com/r/vmware/comments/1ooh3c5/thanks_for_not_patching_skyline_health · Publicação no Reddit
• https://bdu.fstec.ru/vul/2019-01833 · Nota de Segurança
• https://securityfocus.com/bid/105163 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15919 · Aviso do Fabricante
• http://seclists.org/oss-sec/2018/q3/180 · Correção
• https://osv.dev/vulnerability/CVE-2018-15919 · Aviso do Fabricante