Removed CVEs for OpenSSH + added basic detection (#4731)

cves/2016/CVE-2016-6210.yaml

@@ -1,33 +0,0 @@
-id: CVE-2016-6210
-
-info:
-  name: OpenSSH username enumeration < v7.3
-  author: iamthefrogy,forgedhallpass
-  severity: medium
-  description: OpenSSH before 7.3 is vulnerable to username enumeration and DoS vulnerabilities.
-  reference:
-    - http://seclists.org/fulldisclosure/2016/Jul/51
-    - https://security-tracker.debian.org/tracker/CVE-2016-6210
-    - http://openwall.com/lists/oss-security/2016/08/01/2
-    - https://nvd.nist.gov/vuln/detail/CVE-2016-6210
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 5.9
-    cve-id: CVE-2016-6210
-    cwe-id: CWE-200
-  tags: cve,cve2016,network,openssh
-
-network:
-  - host:
-      - "{{Hostname}}"
-      - "{{Host}}:22"
-
-    matchers:
-      - type: regex
-        regex:
-          - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r\n]+|7\.[0-2][^\d][\n^\r]+)'
-
-    extractors:
-      - type: regex
-        regex:
-          - '(?i)SSH-2.0-OpenSSH_[^\r\n]+'

cves/2018/CVE-2018-15473.yaml

@@ -1,33 +0,0 @@
-id: CVE-2018-15473
-
-info:
-  name: OpenSSH Username Enumeration <= v7.7
-  author: r3dg33k,daffainfo,forgedhallpass
-  severity: medium
-  description: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-15473
-    - https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
-    - https://bugs.debian.org/906236
-    - http://www.openwall.com/lists/oss-security/2018/08/15/5
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
-    cvss-score: 5.3
-    cve-id: CVE-2018-15473
-    cwe-id: CWE-362
-  tags: network,openssh,cve,cve2018
-
-network:
-  - host:
-      - "{{Hostname}}"
-      - "{{Host}}:22"
-
-    matchers:
-      - type: regex
-        regex:
-          - '(?i)SSH-2.0-OpenSSH_(?:[1-6][^\d][^\r]+|7\.[0-7][^\d][^\r]+)'
-
-    extractors:
-      - type: regex
-        regex:
-          - '(?i)SSH-2.0-OpenSSH_[^\r]+'

network/openssh-detection.yaml

@@ -0,0 +1,28 @@
+id: openssh-detection
+
+info:
+  name: OpenSSH Detection
+  author: r3dg33k,daffainfo,iamthefrogy
+  severity: info
+  reference:
+    - http://www.openwall.com/lists/oss-security/2016/08/01/2
+    - http://www.openwall.com/lists/oss-security/2018/08/15/5
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-6210
+    - https://nvd.nist.gov/vuln/detail/CVE-2018-15473
+    - http://seclists.org/fulldisclosure/2016/Jul/51
+  tags: network,ssh,openssh
+
+network:
+  - host:
+      - "{{Hostname}}"
+      - "{{Host}}:22"
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)OpenSSH'
+
+    extractors:
+      - type: regex
+        regex:
+          - '(?i)SSH-(.*)-OpenSSH_[^\r]+'