Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-22488 | GEN005539 | SV-35146r1_rule | ECSC-1 | Medium |
Description |
---|
If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges. |
STIG | Date |
---|---|
HP-UX 11.31 Security Technical Implementation Guide | 2015-12-02 |
Check Text ( None ) |
---|
None |
Fix Text (F-30297r1_fix) |
---|
Edit the SSH daemon configuration and add or edit the Compression setting value to no or delayed. |