[nsp] Cisco Security Advisory: Multiple SSH vulnerabilities

From: Cisco Systems Product Security Incident Response Team (psirt@cisco.com)
Date: Wed Jun 27 2001 - 12:28:47 EDT

Next message: Young, Jason: "RE: [nsp] C800 and tacacs"
Previous message: Cisco Systems Product Security Incident Response Team: "[nsp] Cisco Security Advisory: IOS HTTP authorization vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Mail actions: [ respond to this message ] [ mail a new topic ]

-----BEGIN PGP SIGNED MESSAGE-----

Security Advisory: Multiple SSH vulnerabilities

Revision 1.0 - INTERIM

  For public release 2001 June 27 08:00 (UTC -0800)
     _________________________________________________________________

Summary

   Three different Cisco product lines are susceptible to multiple
   vulnerabilities in the Secure Shell (SSH) protocol. These issues are
   inherent to the SSH protocol version 1.5, which is implemented in
   several Cisco product lines.

   By exploiting the weakness in the SSH protocol, it is possible to
   insert an arbitrary commands into an established SSH session, collect
   information that may help in brute force key recovery, or brute force
   a session key.

   Affected product lines are:

     All devices running Cisco IOS software supporting SSH. That includes
          routers and switches running Cisco IOS.

     Catalyst 6000 switches running CatOS.

     Cisco PIX Firewall.

          No other Cisco products are vulnerable.

          It is possible to mitigate this vulnerability by preventing, or
          having a control over, interception of SSH traffic.

          This advisory will be available at
          http://www.cisco.com/warp/public/707/SSH-multiple-pub.html

Affected Products

          An implementation of SSH in multiple Cisco products are
          vulnerable to three different vulnerabilities. These
          vulnerabilities are:

        CRC-32 integrity check vulnerability
                This vulnerability has been described in a CORE SDI S.A.
                paper entitled "An attack on CRC-32 integrity checks of
                encrypted channels using CBC and CFB modes", which can be
                found at http://www.core-sdi.com/soft/ssh/ssh.pdf

                In order for this attack to succeed, an attacker must
                possess one or two known chipertext/plaintext pairs. This
                should not be difficult since every session starts with a
                greeting screen which is fixed and which can be
                determined. This also implies that an attacker must be
                somewhere along the session path in order to be able to
                sniff the session and collect corresponding chipertext.

                For further technical details, see
                http://www.core-sdi.com/soft/ssh/ssh.pdf.

        Traffic analysis
                This issue has been described in an analysis made by
                Solar Designer. It can be found at
                http://www.securityfocus.com/archive/1/169840, and is
                entitled "Passive Analysis of SSH (Secure Shell)
                Traffic".

                To exploit this vulnerability, an attacker must be able
                to capture packets. When sending a packet using the SSH
                protocol, it is padded to the next 8-byte boundary, but
                the exact len of the data (without the padding) is sent
                unencrypted.

                The timing between packets may yield additional
                information, such as the relative position of a letter on
                the keyboard, but that depends on overall jitter in the
                network and the typing habits of the person.

                For additional information, please see
                http://www.securityfocus.com/archive/1/169840.

        Key recovery in SSH protocol 1.5
                This has been discovered by CORE SDI S.A. and the paper
                describing it can be viewed at
                http://www.securityfocus.com/archive/1/161150. The
                subject line is "SSH protocol 1.5 session key recovery
                vulnerability".

                In order to exploit this vulnerability, an attacker must
                be able to sniff the SSH session and must be able to
                establish a connection to the SSH server. In order to
                recover the server key, an attcker must perform an
                additional 2^20+2^19=1572864 connections. Since the key
                has a lifespan of about an hour, this means that an
                attacker must perform around 400 connections per second.

                For further details, please conslut
                http://www.securityfocus.com/archive/1/161150.

Impact

        CRC-32 integrity check vulnerability
                By exploiting this protocol weakness, the attacker can
                insert arbitrary commands in the session after the
                session has been established.

        Traffic analysis
                This vulnerability exposes the exact lengths of the
                passwords used for login authentication. This is only
                applicable to an interactive session that is being
                established over the tunnel protected by SSH. This can
                significantly help an attacker in guessing the password
                using the brute force attack.

        Key recovery in SSH protocol 1.5
                This vulnerability may lead to the compromise of the
                session key. Once the session key is determined, the
                attacker can proceed to decrypt the stored session using
                any implementation of the crypto algorithm used. This
                will reveal all information in an unencrypted form.

Software Versions and Fixes

          Customers with contracts should obtain upgraded software
          through their regular update channels. For most customers, this
          means that upgrades should be obtained through the Software
          Center on Cisco's Worldwide Web site at
          http://www.cisco.com.

          Customers whose Cisco products are provided or maintained
          through prior or existing agreement with third-party support
          organizations such as Cisco Partners, authorized resellers, or
          service providers should contact that support organization for
          assistance with the upgrade, which should be free of charge.

          Customers who purchase directly from Cisco but who do not hold
          a Cisco service contract and customers who purchase through
          third party vendors but are unsuccessful at obtaining fixed
          software through their point of sale should get their upgrades
          by contacting the Cisco Technical Assistance Center (TAC). TAC
          contacts are as follows:

          + +1 800 553 2447 (toll-free from within North America)
          + +1 408 526 7209 (toll call from anywhere in the world)
          + e-mail: tac@cisco.com

          Please have your product serial number available and give the
          URL of this notice as evidence of your entitlement to a
          free upgrade. Free upgrades for non-contract customers must be
          requested through the TAC.

Workarounds

There are no workarounds for these vulnerabilities.

Exploitation and Public Announcements

          All three vulnerabilities are publicly known. Please see the
          Details section for the original announcements.

          The Cisco PSIRT is not aware of malicious use of the
          vulnerabilities described in this advisory.

Status of This Notice: INTERIM

          This is an interim security advisory. Cisco anticipates issuing
          updated versions of this notice at irregular intervals as there
          are material changes in the facts, and will continue to update
          this notice as necessary. The reader is warned that this notice
          may contain inaccurate or incomplete information. Although
          Cisco cannot guarantee the accuracy of all statements in this
          notice, all of the facts have been checked to the best of our
          ability. Cisco anticipates issuing monthly updates of this
          notice until it reaches FINAL status.

          A standalone copy or paraphrase of the text of this security
          advisory that omits the distribution URL in the following
          section is an uncontrolled copy, and may lack important
          information or contain factual errors.

Distribution

          This notice will be posted on Cisco's Worldwide Web site at
          http://www.cisco.com/warp/public/707/SSH-multiple-pub.html.
          In addition to Worldwide Web posting, a text version of this
          notice is clear-signed with the Cisco PSIRT PGP key and is
          posted to the following e-mail and Usenet news recipients:

          + cust-security-announce@cisco.com
          + bugtraq@securityfocus.com
          + first-teams@first.org (includes CERT/CC)
          + cisco@spot.colorado.edu
          + comp.dcom.sys.cisco
          + firewalls@lists.gnac.com
          + Various internal Cisco mailing lists

          Future updates of this notice, if any, will be placed on
          Cisco's Worldwide Web server, but may or may not be actively
          announced on mailing lists or newsgroups. Users concerned about
          this problem are encouraged to check the URL given above for
          any updates.

Revision History

Revision 1.0 2001-June-27 08:00 UTC -0800 Initial public release

Cisco Security Procedures

          Complete information on reporting security vulnerabilities in
          Cisco products, obtaining assistance with security incidents,
          and registering to receive security information from Cisco, is
          available on Cisco's Worldwide Web site at
          http://www.cisco.com/warp/public/707/sec_incident_response.
          shtml. This includes instructions for press inquiries regarding
          Cisco security notices.

          For a list of all advisories please visit
          http://www.cisc.com/warp/public/707/advisory.html page.
            __________________________________________________________

          This notice is Copyright 2000 by Cisco Systems, Inc. This
          notice may be redistributed freely after the release date given
          at the top of the text, provided that redistributed copies are
          complete and unmodified, and include all date and version
          information.
            __________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBOzn6T2iN3BRdFxkbAQHfnggAjJxdGNJpV38nVrVdfKl6QWLbtiJGHB4i
wi3fzNqBV3zOaPwu1VERhq5tco2S/r+WhtOZEq1vEiLjc4ck9sBn6hYH2WqBxJFY
98BZa0qNlzGIESiZdBJXkf6/C0gVnpZ+z2Feox0gnX+Xlow6ENxsCOX92zVXNpp4
DTLNxv2n6sH8RhnthQ1HXTFTck+/IpILKikEUwK4/W2mINc8GmAr0JHH+Fr9UJAR
jzCc8en7Q4y7OYMfUyIOPE6udO9VvG2+J7xpkDRsynFR9HJwibt50yudh23VtdKm
/EyDeB7WPLoZMch3GMK614PrYbq4Wp+hdo+KgJcSB1TH2+J3OJYtzA==
=gpvY
-----END PGP SIGNATURE-----

Next message: Young, Jason: "RE: [nsp] C800 and tacacs"
Previous message: Cisco Systems Product Security Incident Response Team: "[nsp] Cisco Security Advisory: IOS HTTP authorization vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Mail actions: [ respond to this message ] [ mail a new topic ]

This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:12:43 EDT