CVE-2008-5161

Description

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.

Scores

Faiblesses (CWE)

• CWE-329
• CWE-200

Références européennes

• ENISA EUVD · EUVD-2008-5139
• GCVE · GCVE-0-2008-5161

Avis du CERT-FR

• CERTFR-2022-AVI-916 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
• CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
• CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
• CERTA-2012-AVI-594 — Multiples vulnérabilités dans IBM XIV Storage System · cert.ssi.gouv.fr
• CERTA-2009-AVI-487 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.0:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.2:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.1j:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.2j:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.5:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.6:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.7:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.8k:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.3.9k:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.2:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.3:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.4:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.6:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.7:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.8:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.9:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.10:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:4.4.11:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.0f:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.1f:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.2f:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.0.3f:*:*:*:*:*:*:*
• cpe:2.3:a:ssh:tectia_client:5.1.0:*:*:*:*:*:*:*
• +127 autres

Produits affectés

Références

• http://openssh.org/txt/cbc.adv
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1
• http://www.securityfocus.com/bid/32319
• http://secunia.com/advisories/33121
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
• http://osvdb.org/49872
• http://secunia.com/advisories/33308
• http://rhn.redhat.com/errata/RHSA-2009-1287.html
• http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
• http://www.securitytracker.com/id?1021382
• https://kc.mcafee.com/corporate/index?page=content&id=SB10163
• http://osvdb.org/50036
• http://secunia.com/advisories/32833
• http://secunia.com/advisories/36558
• http://osvdb.org/50035
• http://www.ssh.com/company/news/article/953/
• http://www.securitytracker.com/id?1021235
• http://secunia.com/advisories/34857
• http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
• http://support.attachmate.com/techdocs/2398.html
• http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html
• http://www.vupen.com/english/advisories/2008/3173
• http://www.securityfocus.com/archive/1/498579/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46620
• http://secunia.com/advisories/32740
• http://www.vupen.com/english/advisories/2009/1135
• http://secunia.com/advisories/32760
• http://www.vupen.com/english/advisories/2009/3184
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
• http://www.securitytracker.com/id?1021236
• https://kc.mcafee.com/corporate/index?page=content&id=SB10106
• http://marc.info/?l=bugtraq&m=125017764422557&w=2
• http://isc.sans.org/diary.html?storyid=5366
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
• http://www.vupen.com/english/advisories/2008/3409
• http://www.vupen.com/english/advisories/2008/3172
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279
• http://www.securityfocus.com/archive/1/498558/100/0/threaded
• http://support.apple.com/kb/HT3937
• http://www.kb.cert.org/vuls/id/958563

Sources