OpenSSH patch

Ron Colvin Ron.Colvin at nasa.gov
Fri Aug 14 18:44:52 UTC 2015


The CVE in this case was to remedy a flaw that allowed the MaxAuthTries 
limit to be bypassed. The security guide has no control for 
MaxAuthTries. The CIS Benchmark control for RHEL 6 is 4.

On 8/14/15 2:41 PM, Arnold, Paul C CTR USARMY PEO STRI (US) wrote:
> In my view, this would fall under CVEs -- SSG is used to verify configuration compliance (CCEs).
>
> --
> Paul C. Arnold
> IT Systems Engineer
> Cole Engineering Services, Inc.
>
> ________________________________________
> From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Ron Colvin [Ron.Colvin at nasa.gov]
> Sent: Friday, August 14, 2015 01:47 PM
> To: SCAP Security Guide
> Subject: OpenSSH patch
>
> A patch for the SSH bug that bypassed the MaxAuthTries limit was just
> patched. Has MaxAuthTries been considered as a control in the security
> guide?
>
> http://www.openssh.com/txt/release-7.0
> https://threatpost.com/openssh-7-0-fixes-four-flaws/114265
>
> --
>
>
> ********************************************************
> Ron Colvin CISSP, CAP, CEH
> Certified Security Analyst
> NASA - Goddard Space Flight Center
> <ron.colvin at nasa.gov>
> Direct phone 301-286-2451
> NASA Jabber (rdcolvin at im.nasa.gov) AIM rcolvin13
> NASA LCS (ronald.d.colvin at nasa.gov)
> ********************************************************
>
>

-- 


********************************************************
Ron Colvin CISSP, CAP, CEH
Certified Security Analyst
NASA - Goddard Space Flight Center
<ron.colvin at nasa.gov>
Direct phone 301-286-2451
NASA Jabber (rdcolvin at im.nasa.gov) AIM rcolvin13
NASA LCS (ronald.d.colvin at nasa.gov)
********************************************************


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7418 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150814/bf74e6ed/attachment.p7s>


More information about the scap-security-guide mailing list