OpenSSH < 8

Tenable plugin 159491 fires when an SSH server presents an OpenSSH banner older than 8.0, then maps that to CVE-2018-20685, CVE-2019-6109, CVE-2019-6110, and CVE-2019-6111. The problem: those flaws are in the legacy scp client workflow. Exploitation requires a user on the affected host to run scp against a malicious or man-in-the-middle server; it is not a straight unauthenticated attack against the listening sshd service on port 22.

The vendor's MEDIUM label is already modest, but for a server-side exposure queue it is still too generous. The exploit path is post-discovery, user-driven, and workflow-specific, and the plugin itself says detection is based only on the self-reported banner. In real enterprise patch triage, this is mostly classification noise unless the host is actually used as an scp client to pull from untrusted endpoints.

Why this verdict

• Requires the victim to use scp as a client against a malicious or MITM endpoint; that is not the same as exposing sshd to the internet
• Banner-only detection: Tenable says it relied on self-reported version and did not test the vulnerable behavior
• Reachable population collapses fast once you ask the real question: how many of your 10,000 hosts both have old OpenSSH *and* actively pull with legacy scp from untrusted systems?

Why not higher?

A higher severity would make sense for an unauthenticated inbound sshd compromise or for active exploitation evidence, and this is neither. The chain depends on outbound client behavior, often with user or automation participation, and usually yields impact only within the invoking account's local write scope.

Why not lower?

I am not calling this pure nonsense. Old scp clients really can be abused by malicious servers, and if your admin jump boxes or automation nodes still use legacy scp, there is genuine risk. The reason it lands at IGNORE is that the plugin's remote-server framing is the wrong operational queue for that risk.

1. Prefer sftp or rsync — Move routine file-copy workflows off legacy scp where possible. For an IGNORE verdict there is no SLA-driven emergency here, but this is the cleanest structural fix because it removes the risky protocol path entirely.
2. Constrain admin copy workflows — Limit which hosts are allowed to originate ad-hoc file transfers and keep them on managed jump boxes. If a small admin population is the only place scp is used, you shrink the true exposure population without touching every SSH server.
3. Watch for risky scp usage — Alert on scp execution from privileged admin hosts, especially recursive pulls from unfamiliar destinations. This is useful because exploitation needs a transfer event; no transfer, no bug path.
4. Use distro-specific local checks — Favor package/advisory-based local plugins over generic remote version banners. Do this during normal tuning, not as an urgent mitigation, because the real problem here is prioritization noise and backport blind spots.

Run this on the target Linux host, not from the scanner. Invoke it as sudo bash ./check_openssh_159491.sh; root is preferred because RPM changelog checks and package metadata are more reliable with full local access. The script returns PATCHED if it finds upstream >= 8.0 or explicit backport evidence for the bundled CVEs, VULNERABLE for likely unpatched upstream-style installs < 8.0, and UNKNOWN when distro packaging prevents a clean answer.

#!/usr/bin/env bash
# check_openssh_159491.sh
# Verify whether Tenable plugin 159491 reflects a real local scp-client issue.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
CVES='CVE-2018-20685|CVE-2019-6109|CVE-2019-6110|CVE-2019-6111'

have_cmd() { command -v "$1" >/dev/null 2>&1; }

version_ge() {
  # returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

extract_openssh_ver() {
  local out ver
  if have_cmd ssh; then
    out="$(ssh -V 2>&1)"
    ver="$(printf '%s' "$out" | sed -n 's/.*OpenSSH[_-]\([0-9][0-9.]*\)p\{0,1\}[0-9]*.*/\1/p')"
    [ -n "$ver" ] && { printf '%s' "$ver"; return 0; }
  fi
  return 1
}

check_rpm_backport() {
  local pkg
  for pkg in openssh-clients openssh; do
    if rpm -q "$pkg" >/dev/null 2>&1; then
      if rpm -q --changelog "$pkg" 2>/dev/null | grep -Eiq "$CVES"; then
        return 0
      fi
    fi
  done
  return 1
}

check_dpkg_backport() {
  local f
  for f in \
    /usr/share/doc/openssh-client/changelog.Debian.gz \
    /usr/share/doc/openssh-client/changelog.gz \
    /usr/share/doc/openssh/changelog.Debian.gz \
    /usr/share/doc/openssh/changelog.gz; do
    if [ -r "$f" ] && zgrep -Eiq "$CVES" "$f" 2>/dev/null; then
      return 0
    fi
  done
  return 1
}

main() {
  local ver=""
  if ! ver="$(extract_openssh_ver)"; then
    echo UNKNOWN
    exit 2
  fi

  # Upstream 8.0+ includes the mitigation.
  if version_ge "$ver" "8.0"; then
    echo PATCHED
    exit 0
  fi

  # Distro backport evidence beats upstream-style version strings.
  if have_cmd rpm && check_rpm_backport; then
    echo PATCHED
    exit 0
  fi

  if have_cmd dpkg-query && check_dpkg_backport; then
    echo PATCHED
    exit 0
  fi

  # Old upstream-style versions with no backport evidence are likely vulnerable.
  # If this is a locally built OpenSSH without package metadata, treat as vulnerable.
  if [ -x /usr/local/bin/ssh ] || [ -x /usr/local/sbin/sshd ]; then
    echo VULNERABLE
    exit 1
  fi

  # Packaged distro builds often backport without obvious version bumps.
  # If we cannot prove patching, stay conservative and ask for local package review.
  echo UNKNOWN
  exit 2
}

main "$@"

Sources

1. Tenable Nessus Plugin 159491
2. OpenSSH release notes
3. Harry Sintonen advisory on scp client vulnerabilities
4. NVD CVE-2019-6111
5. Ubuntu USN-3885-1
6. Debian DSA-4387-1
7. SUSE note on SCP code vulnerabilities
8. CISA Known Exploited Vulnerabilities Catalog