Vulnerabilidades de Openbsd

CVE-2021-28041 Alta · 7.1 CWE-415 05/03/2021

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common...

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

CVE-2020-15778 Alta · 7.4 CWE-78 24/07/2020

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

CVE-2020-14145 Média · 5.9 CWE-203 29/06/2020

The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an...

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

CVE-2020-12062 Alta · 7.5 CWE-20 01/06/2020

** DISPUTED ** The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server...

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

CVE-2020-7247 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-78 29/01/2020

OpenSMTPD Remote Code Execution Vulnerability

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

CVE-2019-16905 Alta · 7.8 CWE-190 09/10/2019

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a...

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

CVE-2019-6111 Média · 5.9 Exploit público CWE-22 31/01/2019

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp...

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

CVE-2019-6110 Média · 6.8 Exploit público CWE-838 31/01/2019

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a...

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

CVE-2019-6109 Média · 6.8 CWE-116 31/01/2019

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display...

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVE-2016-10009 Alta · 7.3 CWE-426 05/01/2017

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows...

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVE-2006-5051 Alta · 8.1 CWE-415 27/09/2006

Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of...

Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.