SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (VPN)  >   OpenSSH Vendors:   OpenSSH.org
OpenSSH CBC Mode Error Handling May Let Certain Remote Users Obtain Plain Text in Certain Cases
SecurityTracker Alert ID:  1021235
SecurityTracker URL:  http://securitytracker.com/id/1021235
CVE Reference:   CVE-2008-5161   (Links to External Site)
Updated:  Nov 21 2008
Original Entry Date:  Nov 17 2008
Impact:   Disclosure of user information
Vendor Confirmed:  Yes  
Version(s): 4.7p1, possibly other versions
Description:   A vulnerability was reported in OpenSSH. A remote user with control of the network can obtain portions of plain text in certain cases.

A remote user with control of the network between the client and the server can inject connection errors and monitor the SSH error handling response to recover up to 32 bits of plain text from an SSH-protected connection.

The attack process will terminate the SSH connection.

CBC mode connections are affected.

CTR mode connections are not affected.

Martin Albrecht, Kenny Paterson and Gaven Watson from the Information Security Group at Royal Holloway, University of London reported this vulnerability via the Centre for the Protection of National Infrastructure (CPNI).

The original advisory is available at:

http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt

Impact:   A remote user with control of the network can obtain portions of plain text in certain cases.
Solution:   No solution was available at the time of this entry.

The vendor notes that AES CTR mode and arcfour ciphers are not affected and may be preferentially selected by placing the following directive in sshd_config and ssh_config:

Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc

The vendor's advisory is available at:

http://www.openssh.org/txt/cbc.adv

Vendor URL:  www.openssh.org/txt/cbc.adv (Links to External Site)
Cause:   Randomization error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jul 1 2009 (NetBSD Issues Fix) OpenSSH CBC Mode Error Handling May Let Certain Remote Users Obtain Plain Text in Certain Cases
NetBSD has issued a fix for NetBSD 4.0, 4.0.1, and 5.0.
Sep 3 2009 (Red Hat Issues Fix) OpenSSH CBC Mode Error Handling May Let Certain Remote Users Obtain Plain Text in Certain Cases
Red Hat has released a fix for Red Hat Enterprise Linux 5.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC