Products & Services
Support

Product Categories


Popular Downloads


Manage Software

How to Buy

For Home

Linksys Products Store
Linksys is now part of Belkin
Products for everyone

All Ordering Options

Training & Events Partners
Guest

Cisco Security Advisory

OpenSSH Server Vulnerabilities

Advisory ID: cisco-sa-20030917-openssh

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh

Revision 1.6

For Public Release 2003 September 17 07:00  UTC (GMT)

Related Resources:

View related Alert

Summary

New vulnerabilities in the OpenSSH leavingcisco.com implementation for SSH servers have been announced.

An affected network device, running an SSH server based on the OpenSSH implementation, may be vulnerable to a Denial of Service (DoS) attack when an exploit script is repeatedly executed against the same device. There are workarounds available to mitigate the effects of these vulnerabilities.

This advisory will be posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh.

Affected Products

This section provides details on affected products.

Vulnerable Products

The following products, have their SSH server implementation based on the OpenSSH code, and are affected by the OpenSSH vulnerabilities.

  • Cisco Catalyst Switching Software (CatOS)
    Cisco's various Catalyst family of switches run CatOS-based releases or IOS-based releases.
    IOS-based releases are not vulnerable.
    All K9 (crypto) images in 6.x, 7.x, and 8.x release trains are affected by these vulnerabilities. CatOS releases 2.x, 3.x, 4.x and 5.x are not vulnerable as they do not have SSH support.
    The following Cisco Catalyst Switches are vulnerable:
    - Catalyst 6000 series
    - Catalyst 5000 series
    - Catalyst 4000 series
    - Catalyst 2948G, 2980G, 2980G-A, 4912G - use Catalyst 4000 series code base
    To determine your software revision, type show version command at the command line prompt.
  • Cisco Secure Intrusion Detection System (NetRanger) appliance
    The following devices (running software version 3.0(1) through 4.1(1)) are vulnerable:
    - IDS-42xx appliances
    - NM-CIDS
    - WS-SVS-IDSM2
  • Cisco Network Analysis Modules (NAM) for the Cisco Catalyst 6000 and 6500 Series switches and Cisco 7600 Series routers
    The following devices that have applied the K9 crypto patch and have SSH enabled are vulnerable:
    - WS-X6380-NAM, running software version 2.1(2) or 3.1(1a)
    - WS-SVC-NAM-1, running software version 2.2(1a) or 3.1(1a)
    - WS-SVC-NAM-2, running software version 2.2(1a) or 3.1(1a)
  • CiscoWorks 1105 Hosting Solution Engine (HSE)
  • CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)
  • Cisco Content Service CSS 11000 Switch series
  • Cisco Application & Content Networking Software (ACNS)
  • BTS 10200 Softswitch
  • Cisco GSS 4480 Global Site Selector
  • Cisco SN 5428 Storage Router
  • Cisco PGW 2200 Softswitch (formerly known as Cisco VSC 3000 and as Cisco SC 2200)

Cisco has not released code with SSH for the SN5420 storage router.

Products Confirmed Not Vulnerable

The following products, which incorporate a SSH server, have been confirmed to be not vulnerable to the OpenSSH vulnerabilities.

  • Cisco IOS, both SSH version 1.5 and SSH version 2.0
  • Cisco Secure Intrusion Detection System Catalyst Module (IDSM)—model number WS-X6381-IDS
  • Cisco PIX Firewall
  • Cisco Catalyst 6000 FireWall Service Module (FWSM)
  • Cisco VPN 3000 Concentrators and Cisco VPN 5000 Concentrators
  • Cisco MDS 9000 Series Multilayer Switches

No other Cisco products are currently known to be affected by these vulnerabilities.

Details

The buffer size or the number of channels in the fixed code is now correctly incremented only after a successful allocation where as initially they were being set before an allocation. Upon an allocation failure, which could be externally triggered, memory contents would be incorrectly erased by the cleanup process. This would result in a corruption of the memory which would eventually lead to a crash for the process using that memory.

Portable OpenSSH version (not OpenBSD version) 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM authentication code. These vulnerabilities are not known to affect any Cisco products.

Please note, the SSH server code under Cisco IOS has other vulnerabilities as documented by http://www.cisco.com/warp/public/707/ssh-packet-suite-vuln.shtml which may be triggered by the code written to exploit the OpenSHH vulnerabilities.

  • Cisco Catalyst Switching Software (CatOS)—This vulnerability is documented as Bug ID CSCec33092 ( registered customers only) .
    If SSH is disabled the Catalyst switch will not be vulnerable to these vulnerabilities. CatOS K9 (crypto) release 6.1 was the first CatOS release which incorporated the SSH feature.
    To verify if SSH has been configured on the switch type show crypto key. If this shows you the RSA key then SSH has been configured and enabled on the switch. To remove the crypto key type clear crypto key RSA and this will disable the SSH server on the switch.
  • Cisco Secure Intrusion Detection System (NetRanger) appliance—This vulnerability is documented as Bug IDs CSCec32508 ( registered customers only) and CSCec37419 ( registered customers only)
  • Cisco Network Analysis Modules (NAM)—This vulnerability is documented as Bug ID CSCec35975 ( registered customers only) .
    To verify if the K9 crypto patch is installed, type the show patch command. To verify if SSH access has been enabled using the exsession on ssh command, type the show ip command, and if the line starting with "SSH:" shows "Enabled" you are vulnerable.
  • CiscoWorks 1105 Hosting Solution Engine (HSE)—This vulnerability is documented as Bug IDs CSCec34502 ( registered customers only) and CSCec34522 ( registered customers only) .
  • CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)—This vulnerability is documented as Bug IDs CSCec33254 ( registered customers only) and CSCec34521 ( registered customers only) .
  • Cisco Content Service CSS11000 Switch series—Cisco WebNS 5.x, 6.x and 7.x are affected. This vulnerability is documented as Bug ID CSCec35690 ( registered customers only) .
  • Cisco Application & Content Networking Software (ACNS)—All versions affected. This vulnerability is documented as Bug ID CSCec32387 ( registered customers only) .
  • BTS 10200 Softswitch—All releases prior to RLS 3.5.3 are affected. A new openssh package has been made available.
  • Cisco GSS 4480 Global Site Selector—All versions affected. This vulnerability is documented as Bug ID CSCec32245 ( registered customers only) .
  • Cisco SN 5428 Storage Router—
    Vulnerable versions are:
    - SN5428-2.5.1-K9
    - SN5428-3.2.1-K9
    - SN5428-3.2.2-K9
    - SN5428-3.3.1-K9
    - SN5428-3.3.2-K9
    - SN5428-2-3.3.1-K9
    - N5428-2-3.3.2-K9
    This vulnerability is documented as Bug ID CSCec32301 ( registered customers only) . For more information on the SN 5428 please refer to http://www.cisco.com/en/US/products/hw/ps4159/ps2160/index.html.
  • Cisco PGW 2200 Softswitch—The following PGW 2200 components that have applied the CSCOk9000 crypto package found in PGW Restricted Software 1.0(1) are vulnerable:
    - PGW Host platform running MGC application software, and optionally MNM-PT application software
    - HSI host platform running HSI application software
    - BAMS platform running BAMS application software
    - A separate node management platform running the MNM-PT application software

Vulnerability Scoring Details

Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html .

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss .


Impact

An affected device, running an SSH server based on the OpenSSH implementation, may be vulnerable to a DoS attack when an exploit script is repeatedly executed against the same device.

Software Versions and Fixes

When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

  • Cisco Catalyst Switching Software (CatOS)—CatOS release schedule:
    - 6.4(7) for Catalyst 4000/5000/6000 series switches due out on November 12, 2003
    - 7.6(3a) for Catalyst 4000 series switches due out on September 30, 2003
    - 7.6(3a) for Catalyst 6000 series switches due out on September 26, 2003
    - 8.1(3) for Catalyst 6000 series switches due out on October 13, 2003
    - 8.2(1)GLX for Catalyst 4000 series switches due out on September 25, 2003
    - 8.2(1) for Catalyst 6000 series switches due out in 4th Quarter 2003
    Software upgrades can be performed via the console interface. Please refer to software release notes for instructions.
  • Cisco Secure Intrusion Detection System (NetRanger) appliance—Software version 4.1(2), due out end of October, will have the fix. Software version 3.1(5) will have the fix for software version 3.1; release date to be determined.
  • Cisco Network Analysis Modules (NAM)—An updated k9 crypto patch for the 3.1 images, due out middle of October, will have the fix.
  • CiscoWorks 1105 Hosting Solution Engine (HSE)—Software version 1.7.2, due out October 10, will have the fix.
  • CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)—Release date to be determined.
  • Cisco Content Service CSS11000 Switch series—Software versions 5.0.3.10s, 6.10.1.8s, 7.10.3.11s and 7.20.1.10s, due out October 3, will have the fix.
  • Cisco Application & Content Networking Software (ACNS)-Software versions 5.1 and 5.0.7 will have the fix. Software version 5.0.7 is due out September 30.
  • BTS 10200 Softswitch-A new openssh package has been made available. Please contact your Cisco SE for more information.
  • Cisco GSS 4480 Global Site Selector—Software version 1.1(0) code, due out on October 10, will have the fix.
  • Cisco SN 5428 Storage Router—Software version 3.4.1, due out end of September, will have the fix for the SN 5428 and SN 5428-2.
  • Cisco PGW 2200 Softswitch—Software version 1.0(2), due out end of November, will have the fix.

Workarounds

The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code as soon as it is available.

Obtaining Fixed Software

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.

Customers Using Third-Party Support Organizations

Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.

Customers Without Service Contracts

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

  • +1 800 553 2447 (toll free from within North America)
  • +1 408 526 7209 (toll call from anywhere in the world)
  • e-mail: tac@cisco.com

Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any malicious use of the vulnerabilities described in this advisory, at this time.

These vulnerabilities have also been documented by CERT/CC at http://www.cert.org/advisories/CA-2003-24.html leavingcisco.com.

Status of This Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.


Distribution

This advisory will be posted on Cisco's worldwide website at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh.

In addition to worldwide website posting, a text version of this advisory is clear-signed with the Cisco PSIRT PGP key having the fingerprint 8C82 5207 0CA9 ED40 1DD2 EE2A 7B31 A8CF 32B6 B590 and is posted to the following e-mail and Usenet news recipients:

  • cust-security-announce@cisco.com
  • bugtraq@securityfocus.com
  • first-teams@first.org (includes CERT/CC)
  • vulnwatch@vulnwatch.org
  • cisco@spot.colorado.edu
  • cisco-nsp@puck.nether.net
  • full-disclosure@lists.netsys.com
  • comp.dcom.sys.cisco@newsgate.cisco.com
  • Various internal Cisco mailing lists

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.


Revision History

Revision 1.6

2003-November-07

Added Cisco PGW 2200 Softswitch as a vulnerable product. Added 8.1(3) as a fixed release for CatOS.

Revision 1.5

2003-September-27

Added not vulnerable to Portable OpenSSH version in the details section. Added ACNS and BTS10200 as vulnerable. Added 5.x as affected release for CSS11000. Updated fix information for NAM.

Revision 1.4

2003-September-23

Added CatOS release schedule in Software Versions and Fixes.

Revision 1.3

2003-September-19

Added Cisco Content Service CSS11000 Switch series and Cisco Network Analysis Modules (NAM) as being affected.

Revision 1.2

2003-September-18

Added an additional workaround for the CatOS in the Workaround section.

Revision 1.1

2003-September-18

Added CatOS versions, Cisco Secure Intrusion Detection System (NetRanger) appliance, and Cisco GSS 4480 Global Site Selector to the Affected Products section; and Cisco Secure Intrusion Detection System Catalyst Module (IDSM) to the not vulnerable list. Added Cisco Secure Intrusion Detection System (NetRanger) appliance, and Cisco GSS 4480 Global Site Selector to the Details section, and added Bug IDs for the products. Added Cisco Secure Intrusion Detection System (NetRanger) appliance to the Software Versions and Fixes section, and added upcoming fixes for the products.

Revision 1.0

2003-September-17

Initial public release.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.


Download this document (PDF)
View Printable Version