OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability

Bugtraq ID:	46155
Class:	Design Error
CVE:	CVE-2011-0539
Remote:	Yes
Local:	No
Published:	Feb 04 2011 12:00AM
Updated:	May 12 2015 07:46PM
Credit:	Mateusz Kocielski
Vulnerable:	Pardus Linux 2009 0 OpenSSH OpenSSH 5.7 OpenSSH OpenSSH 5.6 Juniper IDP 5.1 HP Insight Control 6.2 HP Insight Control 6.1 HP Insight Control 6.0
Not Vulnerable:	OpenSSH OpenSSH 5.8 Juniper IDP 5.1r4 HP Insight Control 6.3

OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability

OpenSSH is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to gain access to sensitive information; this may lead to further attacks.

Versions prior to OpenSSH 5.8 are vulnerable.

OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability

References:

• OpenSSH 5.8 Release Notes (OpenSSH)
  
• OpenSSH Homepage (OpenSSH)
  
• HPSBMA02658 SSRT100413: HP Insight Control for Linux Multiple Vulnerabilities (HP)
  
• OpenSSH Security Advisory: legacy-certs.adv (OpenSSH)