PT-1998-1145 · Openssh · Ssh
Publicado
1998-06-12
·
Atualizado
2016-10-18
·
CVE-1999-1085
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
SSH versions 1.2.23 through 1.2.25
Description
The issue allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, specifically when SSH is used in CBC or CFB modes.
Recommendations
For SSH version 1.2.23, consider disabling the use of CBC and CFB modes until a patch is available.
For SSH version 1.2.25, avoid using CBC and CFB modes in production environments to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Ssh