Vulnerability Note VU#333980

SSH Communications Secure Shell vulnerable to DoS via malformed BER/DER packet

Overview

SSH Communications' Secure Shell contains vulnerabilities in ASN.1 libraries that may allow remote attackers to cause a denial-of-service situation, or potentially execute arbitrary code on the server.

I. Description

SSH Communications' Secure Shell contains a vulnerability in the decoding of BER/DER encoded packets. According to the SSH Communications Advisory:

BER/DER encoding is applied in digital certificates, which are used for authenticating a user to a host. Certificates are also commonly used for authenticating SSL/TLS connections.

Note that this vulnerability does not affect the non-commercial versions of SSH Secure Shell (Unix), as these versions do not contain the vulnerable ASN.1 related libraries.

This vulnerability may be related to the "Multiple vulnerabilities in SSL/TLS implementations" described in VU#104280.

II. Impact

A remote unauthenticated attaker may be able to crash the target server, causing a denial of service. Exploitation may also permit the execution of arbitrary code.

III. Solution

SSH Communications has released version 3.2.9 of SSH Secure Shell to resolve this issue. Please see the SSH Communications' Advisory for more details on upgrading. Likewise, vendors that redistribute versions of this product may provide their own patches or updates.

According to the SSH Communications' Advisory:

Your server is not vulnerable if:

You are using password authentication only
You use the non-commercial Unix distribution that does not contain the PKI functionality.
You allow public key authentication WITHOUT specifying the "Pki" keyword in the server configuration file (sshd2_config).

Systems Affected

Vendor	Status	Date Notified
AppGate Network Security AB	Not Vulnerable	3-Oct-2003
Bitvise	Not Vulnerable	3-Oct-2003
F-Secure	Vulnerable	7-Oct-2003
MacSSH	Not Vulnerable	7-Oct-2003
Riverstone Networks	Not Vulnerable	3-Oct-2003
SSH Communications Security	Vulnerable	3-Oct-2003
Stonesoft	Vulnerable	3-Oct-2003

References

http://www.ssh.com/company/newsroom/article/476/
http://www.stonesoft.com/document/art/3041.html

Credit

Thanks to Stonesoft for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

Date Public:	2003-10-03
Date First Published:	2003-10-03
Date Last Updated:	2003-10-07
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	12.60
Document Revision:	6

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader