PT-1998-1145 · Openssh · Ssh

Published 1998-06-12 · Updated 2016-10-18 · CVE-1999-1085

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SSH versions 1.2.23 through 1.2.25

Description The issue allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, specifically when SSH is used in CBC or CFB modes.

Recommendations For SSH version 1.2.23, consider disabling the use of CBC and CFB modes until a patch is available. For SSH version 1.2.25, avoid using CBC and CFB modes in production environments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-1999-1085

Affected Products

Ssh

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-1999-1085 · Security Note
• http://marc.info/?l=bugtraq&m=90221104525878&w=2 · Note
• http://iss.net/security_center/static/1126.php · Note
• http://kb.cert.org/vuls/id/13877 · Note
• http://marc.info/?l=bugtraq&m=90221103125884&w=2 · Note