Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.100153
Category:General
Title:OpenSSH CBC Mode Information Disclosure Vulnerability
Summary:The host is installed with OpenSSH and is prone to information; disclosure vulnerability.
Description:Summary:
The host is installed with OpenSSH and is prone to information
disclosure vulnerability.

Vulnerability Insight:
The flaw is due to the improper handling of errors within an SSH session
encrypted with a block cipher algorithm in the Cipher-Block Chaining 'CBC' mode.

Vulnerability Impact:
Successful exploits will allow attackers to obtain four bytes of plaintext from
an encrypted session.

Affected Software/OS:
Versions prior to OpenSSH 5.2 are vulnerable. Various versions of SSH Tectia
are also affected.

Solution:
Upgrade to OpenSSH 5.2 or later.

CVSS Score:
2.6

CVSS Vector:
AV:N/AC:H/Au:N/C:P/I:N/A:N

Cross-Ref: BugTraq ID: 32319
Common Vulnerability Exposure (CVE) ID: CVE-2008-5161
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
http://www.securityfocus.com/bid/32319
Bugtraq: 20081121 OpenSSH security advisory: cbc.adv (Google Search)
http://www.securityfocus.com/archive/1/498558/100/0/threaded
Bugtraq: 20081123 Revised: OpenSSH security advisory: cbc.adv (Google Search)
http://www.securityfocus.com/archive/1/498579/100/0/threaded
CERT/CC vulnerability note: VU#958563
http://www.kb.cert.org/vuls/id/958563
HPdes Security Advisory: HPSBMA02447
http://marc.info/?l=bugtraq&m=125017764422557&w=2
HPdes Security Advisory: SSRT090062
http://isc.sans.org/diary.html?storyid=5366
http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
http://osvdb.org/49872
http://osvdb.org/50035
http://osvdb.org/50036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279
RedHat Security Advisories: RHSA-2009:1287
http://rhn.redhat.com/errata/RHSA-2009-1287.html
http://www.securitytracker.com/id?1021235
http://www.securitytracker.com/id?1021236
http://www.securitytracker.com/id?1021382
http://secunia.com/advisories/32740
http://secunia.com/advisories/32760
http://secunia.com/advisories/32833
http://secunia.com/advisories/33121
http://secunia.com/advisories/33308
http://secunia.com/advisories/34857
http://secunia.com/advisories/36558
http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1
http://www.vupen.com/english/advisories/2008/3172
http://www.vupen.com/english/advisories/2008/3173
http://www.vupen.com/english/advisories/2008/3409
http://www.vupen.com/english/advisories/2009/1135
http://www.vupen.com/english/advisories/2009/3184
XForce ISS Database: openssh-sshtectia-cbc-info-disclosure(46620)
https://exchange.xforce.ibmcloud.com/vulnerabilities/46620
CopyrightCopyright (C) 2009 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.