The CVE in this case was to remedy a flaw that allowed the MaxAuthTries
limit to be bypassed. The security guide has no control for
MaxAuthTries. The CIS Benchmark control for RHEL 6 is 4.
On 8/14/15 2:41 PM, Arnold, Paul C CTR USARMY PEO STRI (US) wrote:
In my view, this would fall under CVEs -- SSG is used to verify
configuration compliance (CCEs).
--
Paul C. Arnold
IT Systems Engineer
Cole Engineering Services, Inc.
________________________________________
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Ron Colvin
[Ron.Colvin(a)nasa.gov]
Sent: Friday, August 14, 2015 01:47 PM
To: SCAP Security Guide
Subject: OpenSSH patch
A patch for the SSH bug that bypassed the MaxAuthTries limit was just
patched. Has MaxAuthTries been considered as a control in the security
guide?
http://www.openssh.com/txt/release-7.0
https://threatpost.com/openssh-7-0-fixes-four-flaws/114265
--
********************************************************
Ron Colvin CISSP, CAP, CEH
Certified Security Analyst
NASA - Goddard Space Flight Center
<ron.colvin(a)nasa.gov>
Direct phone 301-286-2451
NASA Jabber (rdcolvin(a)im.nasa.gov) AIM rcolvin13
NASA LCS (ronald.d.colvin(a)nasa.gov)
********************************************************
--
********************************************************
Ron Colvin CISSP, CAP, CEH
Certified Security Analyst
NASA - Goddard Space Flight Center
<ron.colvin(a)nasa.gov>
Direct phone 301-286-2451
NASA Jabber (rdcolvin(a)im.nasa.gov) AIM rcolvin13
NASA LCS (ronald.d.colvin(a)nasa.gov)
********************************************************