Open Source Development

Power Open Source Development

Explore the open source tools and capabilities for building and deploying modern applications on IBM Power platforms including AIX, IBM i, and Linux.


#Power


#Power


#Servers
#Opensource
 View Only

  • 1.  OpenSSH 9.7.3013.1000 vulnerable CVE-2024-6387,CVE-2024-39894

    Posted 12/17/24 11:15 AM

    We received from our security department using Tenable that OpenSSH 9.7.3013.1000 is vulnerable asking us to upgrade to OpenSSH version 9.8 or later.

    Looking for an ETA to forward to our security department.

    Thanks



    ------------------------------
    Scott Gruber
    ------------------------------

    #AIXOpenSource


  • 2.  RE: OpenSSH 9.7.3013.1000 vulnerable CVE-2024-6387,CVE-2024-39894

    Posted 12/17/24 12:10 PM

    CVE-2024-39894 is only about hidden text (ie: remote su or sudo) prompts, which doesn't sound particularly threatening.

    CVE-2024-6387 is a potential RCE do to a race condition in Login Grace Timeout. This can be fixed set setting the value to 0 in sshd_config, which could cause other problems if you use SSH frequently.

    The race condition is between sshd and Linux glibc syslog(), and may not be relevant for AIX. If you have anything on that, please post it.

    https://www.ibm.com/support/pages/security-bulletin-aix-vulnerable-arbitrary-code-execution-cve-2024-6387-due-openssh

    IBM posted a CVE for that, but only for 9.2.

    Otherwise IBM is publishing (for unknown reasons) SSH updates on their MRS site: https://www.ibm.com/resources/mrs/assets/DirectDownload?source=aixbp&lang=en_US

    9.7.3013.1000 is the latest they have there.

    That's not really the AIX Open Source area, those are from IBM and not part of the AIX Toolkit.



    ------------------------------
    ========================
    Russell Adams
    https://adamssystems.nl/
    ========================
    ------------------------------



  • 3.  RE: OpenSSH 9.7.3013.1000 vulnerable CVE-2024-6387,CVE-2024-39894

    Posted 01/06/25 08:52 AM

    Do You have any update/news on this case?

    I was asked on my side what to do with "https://www.tenable.com/plugins/nessus/201194" on some of our AIX system with OpenSSH 9.7.3013.1000.

    I'm not able to find any information from IBM regarding this issue.

    =================
    Tom Kristen Hansen
    =================



    ------------------------------
    Tom Kristen Hansen
    ------------------------------



  • 4.  RE: OpenSSH 9.7.3013.1000 vulnerable CVE-2024-6387,CVE-2024-39894

    Posted 01/07/25 01:56 AM

    I found this which solved the case; https://www.ibm.com/support/pages/aix-security-vulnerability-scanner-tools-fails-detect-openssh-version

    OpenSSH 9.7.3013.1000 is actually version 9.8.



    ------------------------------
    Tom Kristen Hansen
    ------------------------------



Related Content