IT Employment

Ask something
Discussion Locked

SSH security flaw

0 helpful
3 replies

by madroxxx

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Does the SSH security flaw found today affect Cisco products?

3 replies

by lordinfidel

This advisory will be posted at
http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml.

Affected Products

The following products, have their SSH server implementation based on the
OpenSSH code, and are affected by the OpenSSH vulnerabilities.

Cisco Catalyst Switching Software (CatOS)

* CiscoWorks 1105 Hosting Solution Engine (HSE)

* CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)

* Cisco SN 5428 Storage Router

Vulnerable versions are:

* SN5428-2.5.1-K9

* SN5428-3.2.1-K9

* SN5428-3.2.2-K9

* SN5428-3.3.1-K9

* SN5428-3.3.2-K9

* SN5428-2-3.3.1-K9

* SN5428-2-3.3.2-K9

This does not include release sr2122-3.1.1-K9, which only contains SSL and
no SSH. Cisco has not released code with SSH for the SN5420 storage
router.

The following products, which incorporate a SSH server, have been
confirmed to be not vulnerable to the OpenSSH vulnerabilities.

* Cisco IOS, both SSH version 1.5 and SSH version 2.0

* Cisco PIX Firewall

* Cisco Catalyst 6000 FireWall Service Module (FWSM)

* Cisco VPN3000 and Cisco VPN5000

by lordinfidel

Now i'm not saying don't patch. That would not be prudent of me.

As I read it, as well as the other members of my team. As well as Dave Ahmad from the OpenSSH team, and I quote:

"All versions of OpenSSH's sshd prior to 3.7 contain a buffer management error. It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs
fixed proactively."

Cisco confirms that when a exploit script is run repeatedly against the SSH server, that a DoS can occur.

RedHat on the other hand calls it a remote exploit.(!?!)

This is one of those times where, if you have employed SSH properly, that is using ACL's to prevent anyone to just connect to it. Then the likelyhood that you will be affected is extremely unlikely. Unless of course you DoS yourself.

And if you are using a cisco product, you should have extreme ACL's set up anyways dictating who can/cannot make direct connections to the device.

After all. Cisco themselves admit that they have many other vuln's other then just this.

This discussion is closed to new replies.