PT-2006-7550 · Debian · Lsh-Utils-Doc+4

Stefan Pfetzing · Published 1970-01-01 · Updated 2017-07-20 · CVE-2006-0353

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions lsh-server versions 2.0.1 and earlier lsh-client versions 2.0.1 and earlier lsh-utils versions 2.0.1 and earlier lsh-utils-doc versions 2.0.1 and earlier

Description The issue concerns multiple vulnerabilities in the lsh package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality and availability of protected information. These vulnerabilities can be exploited by a local attacker. Specifically, in lshd for lsh 2.0.1, the unix random.c file leaks file descriptors related to the randomness generator. This allows local users to cause a denial of service by truncating the seed file, preventing the server from starting, or obtain sensitive seed information that could be used to crack keys.

Recommendations For lsh-server version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk. For lsh-client version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk. For lsh-utils version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk. For lsh-utils-doc version 2.0.1 and earlier, consider updating to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the unix random.c file to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-02045

BDU:2015-02046

BDU:2015-02047

BDU:2015-02048

CVE-2006-0353

DSA-956-1

Affected Products

Debian

Lsh-Client

Lsh-Server

Lsh-Utils

Lsh-Utils-Doc

References · 18

• https://bdu.fstec.ru/vul/2015-02045 · Security Note
• https://bdu.fstec.ru/vul/2015-02048 · Security Note
• http://secunia.com/advisories/18564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0353 · Security Note
• https://bdu.fstec.ru/vul/2015-02047 · Security Note
• http://debian.org/security/2006/dsa-956 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0301 · Vendor Advisory
• http://secunia.com/advisories/18623 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-0353 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0353 · Security Note
• http://securityfocus.com/bid/16357 · Patch
• https://bdu.fstec.ru/vul/2015-02046 · Security Note
• http://lists.lysator.liu.se/pipermail/lsh-bugs/2006q1/000467.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0353 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-0353 · Vendor Advisory