SSH Secure Shell/Tectia Server on Windows Host Identification Key Permission Vulnerability

Bugtraq ID:	14116
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 30 2005 12:00AM
Updated:	Jun 30 2005 12:00AM
Credit:	This issue was announced by the vendor.
Vulnerable:	SSH Communications Security Tectia Server 4.3.1 SSH Communications Security Tectia Server 4.2.1 SSH Communications Security Tectia Server 4.0.5 SSH Communications Security Tectia Server 4.0.4 SSH Communications Security Tectia Server 4.0.3 SSH Communications Security Tectia Server 4.0 SSH Communications Security SSH2 for Win32 3.1.2 SSH Communications Security SSH2 for Win32 3.1.1 SSH Communications Security SSH2 for Win32 3.1 SSH Communications Security SSH2 3.2.9 SSH Communications Security SSH2 3.2.5 SSH Communications Security SSH2 3.2.4 SSH Communications Security SSH2 3.2.3 SSH Communications Security SSH2 3.2.2 SSH Communications Security SSH2 3.2.1 SSH Communications Security SSH2 3.2 SSH Communications Security SSH2 3.1.8 SSH Communications Security SSH2 3.1.7 SSH Communications Security SSH2 3.1.6 SSH Communications Security SSH2 3.1.5 SSH Communications Security SSH2 3.1.4 SSH Communications Security SSH2 3.1.3 SSH Communications Security SSH2 3.1.2 SSH Communications Security SSH2 3.1.1 SSH Communications Security SSH2 3.1 SSH Communications Security SSH2 3.0.1 SSH Communications Security SSH2 2.5 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SSH Communications Security SSH2 2.4 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SSH Communications Security SSH2 2.3 SSH Communications Security SSH2 2.2 SSH Communications Security SSH2 2.1 SSH Communications Security SSH2 2.0.13 SSH Communications Security SSH2 2.0.12 SSH Communications Security SSH2 2.0.11 SSH Communications Security SSH2 2.0.10 SSH Communications Security SSH2 2.0.9 SSH Communications Security SSH2 2.0.7 SSH Communications Security SSH2 2.0.6 SSH Communications Security SSH2 2.0.5 SSH Communications Security SSH2 2.0.4 SSH Communications Security SSH2 2.0.3 SSH Communications Security SSH2 2.0.2 SSH Communications Security SSH2 2.0.1 SSH Communications Security SSH2 2.0 SSH Communications Security SSH 1.2.31 - BSDI BSD/OS 4.0.1 - BSDI BSD/OS 4.0 - BSDI BSD/OS 3.1 - Caldera OpenLinux Desktop 2.3 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 - Digital (Compaq) TRU64/DIGITAL UNIX 5.0 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 g - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.5 - NetBSD NetBSD 1.4.3 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - OpenBSD OpenBSD 2.6 - Redhat Linux 7.0 - Redhat Linux 6.2 - SCO eDesktop 2.4 - SCO eServer 2.3.1 - SGI IRIX 6.5.8 - SGI IRIX 6.5.7 - SGI IRIX 6.5.6 - Slackware Linux 7.1 - Slackware Linux 7.0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.0 - SuSE Linux 6.4 - Wirex Immunix OS 7.0 -Beta - Wirex Immunix OS 7.0 - Wirex Immunix OS 6.2 SSH Communications Security SSH 1.2.31 SSH Communications Security SSH 1.2.30 - BSDI BSD/OS 4.0.1 - BSDI BSD/OS 4.0 - BSDI BSD/OS 3.1 - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Digital (Compaq) TRU64/DIGITAL UNIX 5.0 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 g - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - OpenBSD OpenBSD 2.8 - Redhat Linux 7.0 - Redhat Linux 6.2 - SCO eDesktop 2.4 - SCO eServer 2.3.1 - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.0 - SuSE Linux 6.4 SSH Communications Security SSH 1.2.29 SSH Communications Security SSH 1.2.28 SSH Communications Security SSH 1.2.27 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 SSH Communications Security SSH 1.2.26 SSH Communications Security SSH 1.2.25 SSH Communications Security SSH 1.2.24 SSH Communications Security SSH 1.2.23 SSH Communications Security SSH 1.2.22 SSH Communications Security SSH 1.2.21 SSH Communications Security SSH 1.2.20 SSH Communications Security SSH 1.2.19 SSH Communications Security SSH 1.2.18 SSH Communications Security SSH 1.2.17 SSH Communications Security SSH 1.2.16 SSH Communications Security SSH 1.2.15 SSH Communications Security SSH 1.2.14 SSH Communications Security SSH 1.2.13 SSH Communications Security SSH 1.2.12 SSH Communications Security SSH 1.2.11 SSH Communications Security SSH 1.2.10 SSH Communications Security SSH 1.2.9 SSH Communications Security SSH 1.2.8 SSH Communications Security SSH 1.2.7 SSH Communications Security SSH 1.2.6 SSH Communications Security SSH 1.2.5 SSH Communications Security SSH 1.2.4 SSH Communications Security SSH 1.2.3 SSH Communications Security SSH 1.2.2 SSH Communications Security SSH 1.2.1
Not Vulnerable:	SSH Communications Security Tectia Server 4.3.2

SSH Secure Shell/Tectia Server on Windows Host Identification Key Permission Vulnerability

SSH Secure Shell/Tectia Server on Windows platforms are prone to a vulnerability that could disclose private keys to other users of the computer. This is due to insecure default permissions on the file containing the private key.

A malicious user who obtains the host identification key could potentially use the key in attacks against clients.

SSH Secure Shell was re-branded Tectia Server as of Tectia Server release 4.0.

SSH Secure Shell/Tectia Server on Windows Host Identification Key Permission Vulnerability

There is no exploit required.

SSH Secure Shell/Tectia Server on Windows Host Identification Key Permission Vulnerability

Solution:
This issue has been addressed in Tectia Server 4.3.2. Fixes are available to users with support licenses.


SSH Communications Security Tectia Server 4.0

• SSH Communications Security TectiaServer-T-upgrade-4.3.2.12.zip
  http://ftp.ssh.com/priv/secureshell/4.3.2-winsrv-GwvoWd/TectiaServer-T -upgrade-4.3.2.12.zip

SSH Communications Security Tectia Server 4.0.3

• SSH Communications Security TectiaServer-T-upgrade-4.3.2.12.zip
  http://ftp.ssh.com/priv/secureshell/4.3.2-winsrv-GwvoWd/TectiaServer-T -upgrade-4.3.2.12.zip

SSH Communications Security Tectia Server 4.0.4

• SSH Communications Security TectiaServer-T-upgrade-4.3.2.12.zip
  http://ftp.ssh.com/priv/secureshell/4.3.2-winsrv-GwvoWd/TectiaServer-T -upgrade-4.3.2.12.zip

SSH Communications Security Tectia Server 4.0.5

• SSH Communications Security TectiaServer-T-upgrade-4.3.2.12.zip
  http://ftp.ssh.com/priv/secureshell/4.3.2-winsrv-GwvoWd/TectiaServer-T -upgrade-4.3.2.12.zip

SSH Communications Security Tectia Server 4.2.1

• SSH Communications Security TectiaServer-T-upgrade-4.3.2.12.zip
  http://ftp.ssh.com/priv/secureshell/4.3.2-winsrv-GwvoWd/TectiaServer-T -upgrade-4.3.2.12.zip

SSH Communications Security Tectia Server 4.3.1

• SSH Communications Security TectiaServer-T-upgrade-4.3.2.12.zip
  http://ftp.ssh.com/priv/secureshell/4.3.2-winsrv-GwvoWd/TectiaServer-T -upgrade-4.3.2.12.zip

SSH Secure Shell/Tectia Server on Windows Host Identification Key Permission Vulnerability

References:

• SSH Communications Homepage (SSH Communications)
  
• SSH Tectia Server Private Key Permission Vulnerability in Windows (SSH Communications Security)