OpenSSH J-PAKE Security Bypass Vulnerability

Bugtraq ID:	45304
Class:	Unknown
CVE:	CVE-2010-4478
Remote:	Yes
Local:	No
Published:	Dec 02 2010 12:00AM
Updated:	May 07 2015 06:17PM
Credit:	Sebastien Martini
Vulnerable:	OpenSSH OpenSSH 5.6 OpenSSH OpenSSH 5.5 OpenSSH OpenSSH 5.4 OpenSSH OpenSSH 5.3 OpenSSH OpenSSH 5.2 OpenSSH OpenSSH 5.1 OpenSSH OpenSSH 5.0 Gentoo Linux
Not Vulnerable:

OpenSSH J-PAKE Security Bypass Vulnerability

OpenSSH is prone to a security-bypass vulnerability.

A successful exploit may allow attackers to authenticate without the shared secret, aiding in further attacks.

OpenSSH's implementation of J-PAKE is experimental and is not compiled in by default.

OpenSSH 5.6 and prior with J-PAKE implemented are vulnerable.

OpenSSH J-PAKE Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSH J-PAKE Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

OpenSSH J-PAKE Security Bypass Vulnerability

References:

• CVS log (OpenSSH)
  
• OpenSSH Home Page (OpenBSD)
  
• Session Key Retrieval in J-PAKE Implementations of OpenSSL and OpenSSH (Sebastien Martini)