CERT/CC Vulnerability Note VU#333980

Overview

SSH Communications' Secure Shell contains vulnerabilities in ASN.1 libraries that may allow remote attackers to cause a denial-of-service situation, or potentially execute arbitrary code on the server.

Description

SSH Communications' Secure Shell contains a vulnerability in the decoding of BER/DER encoded packets. According to the SSH Communications Advisory:

BER/DER encoding is applied in digital certificates, which are used for authenticating a user to a host. Certificates are also commonly used for authenticating SSL/TLS connections.

Note that this vulnerability does not affect the non-commercial versions of SSH Secure Shell (Unix), as these versions do not contain the vulnerable ASN.1 related libraries.

This vulnerability may be related to the "Multiple vulnerabilities in SSL/TLS implementations" described in VU#104280.

Impact

A remote unauthenticated attaker may be able to crash the target server, causing a denial of service. Exploitation may also permit the execution of arbitrary code.

Solution

SSH Communications has released version 3.2.9 of SSH Secure Shell to resolve this issue. Please see the SSH Communications' Advisory for more details on upgrading. Likewise, vendors that redistribute versions of this product may provide their own patches or updates.

According to the SSH Communications' Advisory:

Your server is not vulnerable if:

You are using password authentication only
You use the non-commercial Unix distribution that does not contain the PKI functionality.
You allow public key authentication WITHOUT specifying the "Pki" keyword in the server configuration file (sshd2_config).

Vendor Information

333980

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

F-Secure Affected

SSH Communications Security Affected

Stonesoft Affected

AppGate Network Security AB Not Affected

Bitvise Not Affected

MacSSH Not Affected

Riverstone Networks Not Affected

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Stonesoft for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

CVE IDs:	None
Severity Metric:	12.60
Date Public:	2003-10-03
Date First Published:	2003-10-03
Date Last Updated:	2003-10-07 13:45 UTC
Document Revision:	7

Software Engineering Institute

CERT Coordination Center

SSH Communications Secure Shell vulnerable to DoS via malformed BER/DER packet

Vulnerability Note VU#333980