According to its banner, the version of OpenSSH running on the remote host is prior to 7.0. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in the     kbdint_next_device() function in file auth2-chall.c that     allows the circumvention of MaxAuthTries during     keyboard-interactive authentication. A remote attacker     can exploit this issue to force the same authentication     method to be tried thousands of times in a single pass     by using a crafted keyboard-interactive 'devices'     string, thus allowing a brute-force attack or causing a     denial of service. (CVE-2015-5600)

  - A security bypass vulnerability exists in sshd due to     improper handling of username data in     MONITOR_REQ_PAM_INIT_CTX requests. A local attacker can     exploit this, by sending a MONITOR_REQ_PWNAM request, to     conduct an impersonation attack. Note that this issue     only affects Portable OpenSSH. (CVE-2015-6563)

  - A privilege escalation vulnerability exists due to a     use-after-free error in sshd that is triggered when     handling a MONITOR_REQ_PAM_FREE_CTX request. A local     attacker can exploit this to gain elevated privileges.
    Note that this issue only affects Portable OpenSSH.
    (CVE-2015-6564)

  - A local command execution vulnerability exists in sshd     due to setting insecure world-writable permissions for     TTYs. A local attacker can exploit this, by injecting     crafted terminal escape sequences, to execute commands     for logged-in users. (CVE-2015-6565)

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. (CVE-2015-6563)

Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
(CVE-2015-6564)

openssh was updated to fix several security issues and bugs.

These security issues were fixed :

  - CVE-2015-5352: The x11_open_helper function in     channels.c in ssh in OpenSSH when ForwardX11Trusted mode     is not used, lacked a check of the refusal deadline for     X connections, which made it easier for remote attackers     to bypass intended access restrictions via a connection     outside of the permitted time window (bsc#936695).

  - CVE-2015-5600: The kbdint_next_device function in     auth2-chall.c in sshd in OpenSSH did not properly     restrict the processing of keyboard-interactive devices     within a single connection, which made it easier for     remote attackers to conduct brute-force attacks or cause     a denial of service (CPU consumption) via a long and     duplicative list in the ssh -oKbdInteractiveDevices     option, as demonstrated by a modified client that     provides a different password for each pam element on     this list (bsc#938746).

  - CVE-2015-4000: Removed and disabled weak DH groups to     address LOGJAM (bsc#932483).

  - Hardening patch to fix sftp RCE (bsc#903649).

  - CVE-2015-6563: The monitor component in sshd in OpenSSH     accepted extraneous username data in     MONITOR_REQ_PAM_INIT_CTX requests, which allowed local     users to conduct impersonation attacks by leveraging any     SSH login access in conjunction with control of the sshd     uid to send a crafted MONITOR_REQ_PWNAM request, related     to monitor.c and monitor_wrap.c.

  - CVE-2015-6564: Use-after-free vulnerability in the     mm_answer_pam_free_ctx function in monitor.c in sshd in     OpenSSH might have allowed local users to gain     privileges by leveraging control of the sshd uid to send     an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is 10.9.5 or later but prior to 10.11.1 It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework (CVE-2015-5940)

  - apache_mod_php (CVE-2015-0235, CVE-2015-0273,     CVE-2015-6834, CVE-2015-6835, CVE-2015-6836,     CVE-2015-6837, CVE-2015-6838)

  - ATS (CVE-2015-6985)

  - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)

  - Bom (CVE-2015-7006)

  - CFNetwork (CVE-2015-7023)

  - configd (CVE-2015-7015)

  - CoreGraphics (CVE-2015-5925, CVE-2015-5926)

  - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992,     CVE-2015-7017)

  - Directory Utility (CVE-2015-6980)

  - Disk Images (CVE-2015-6995)

  - EFI (CVE-2015-7035)

  - File Bookmark (CVE-2015-6987)

  - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976,     CVE-2015-6977, CVE-2015-6978, CVE-2015-6990,     CVE-2015-6991, CVE-2015-6993, CVE-2015-7008,     CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)

  - Grand Central Dispatch (CVE-2015-6989)

  - Graphics Drivers (CVE-2015-7019, CVE-2015-7020,     CVE-2015-7021)

  - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937,     CVE-2015-5938, CVE-2015-5939)

  - IOAcceleratorFamily (CVE-2015-6996)

  - IOHIDFamily (CVE-2015-6974)

  - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)

  - libarchive (CVE-2015-6984)

  - MCX Application Restrictions (CVE-2015-7016)

  - Net-SNMP (CVE-2014-3565, CVE-2012-6151)

  - OpenGL (CVE-2015-5924)

  - OpenSSH (CVE-2015-6563)

  - Sandbox (CVE-2015-5945)

  - Script Editor (CVE-2015-7007)

  - Security (CVE-2015-6983, CVE-2015-7024)

  - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2088 advisory.

    - Security fixes released with openssh-6.9 (CVE-2015-5352) (#1247864)
     - XSECURITY restrictions bypass under certain conditions in ssh(1) (#1238231)
     - weakness of agent locking (ssh-add -x) to password guessing (#1238238)
    - only query each keyboard-interactive device once (CVE-2015-5600) (#1245971)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
85382	OpenSSH < 7.0 Multiple Vulnerabilities	Nessus	Misc.	2015/8/13	2024/3/27	medium
85750	Amazon Linux AMI : openssh (ALAS-2015-592)	Nessus	Amazon Linux Local Security Checks	2015/9/3	2018/4/18	medium
86057	SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2015:1581-1) (Logjam)	Nessus	SuSE Local Security Checks	2015/9/22	2022/12/5	low
86654	Mac OS X < 10.11.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/10/29	2024/5/28	critical
87019	Oracle Linux 7 : openssh (ELSA-2015-2088)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2024/10/22	high

検出

プラグインの検索

medium

medium

low

critical

high