Vulnerability Note VU#13877
Weak CRC allows packet injection into SSH sessions encrypted with block ciphers
There is an information integrity vulnerability in the SSH1 protocol that allows packets encrypted with a block cipher to be modified without notice.
Attacker has a fragment of plaintext and its corresponding ciphertext.
An attacker can modify arbitrary packets within an encrypted SSH session.
Apply a patch from your vendor
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Cisco Systems Inc.||Affected||-||27 Jun 2002|
|OpenSSH||Affected||-||06 Nov 2001|
|SSH Communications Security||Affected||-||06 Nov 2001|
CVSS Metrics (Learn More)
This vulnerability was first published by CORE-SDI on June 11, 1998.
This document was written by Jeffrey P. Lanza.
- CVE IDs: CVE-1999-1085
- Date Public: 11 Jun 98
- Date First Published: 06 Nov 2001
- Date Last Updated: 19 May 2003
- Severity Metric: 6.84
- Document Revision: 20
If you have feedback, comments, or additional information about this vulnerability, please send us email.