3

I'm running OpenSSH 5.3p1-81.el6_3, which according to my server is the latest stable version. My PCI scan is showing CVE-2010-4478 and CVE-2011-0539 exploits as being present due to my OpenSSH version.

Checking "rpm -q --changelog openssh" shows that there have been updates as late as october 2012. Surely these have been resolved? There are newer versions of SSH (6.x I believe) but from what I can tell, rehat/centos backports security fixes to old stable versions like 5.3.

Are these fixed in my version or aren't they? If yes, how can I show this to my PCI scanner to prove a false positive?

Thanks!

1 Answer 1

7

Yes, you are up to date, and not vulnerable to these particular vulnerabilities.

To resolve this, you need to look up each CVE at Red Hat and note the status of the package. In some cases, a backported fix will be available. In others, the package won't be vulnerable because of various factors (for instance, the vulnerable functionality may not be present in the vendor's build).

In the case of backported fixes, if you have the same or a newer package as that noted in the advisory, you are fine. You simply note that your package contains a backported fix and use the information from Red Hat as evidence that the fix has been applied.

For packages listed by the vendor as not vulnerable, just provide the information given.

In this particular case, the CVEs are:

2
  • Thanks for the information. I just put in a false positive exception request for access.redhat.com/security/cve/CVE-2011-0539 since I'm not running OpenSSH 5.6 or 5.7. For CVE-2010-4478, however, I'm not exactly sure how I can go about showing that I'm good to go on that one since it says "5.6 or earlier". It says "not vulnerable" because it wasn't shipped to redhat 4 5 or 6 but I'm on centos. Any ideas?
    – Citizen
    Dec 18, 2012 at 21:05
  • CentOS is an identical clone of RHEL. There's no functional difference, and in practice the PCI auditors have always accepted Red Hat statements, applied to a CentOS system, so long as the package versions match. Dec 18, 2012 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .