OpenSSH Ciphersuite Specification Information Disclosure Weakness

Bugtraq ID:	49473
Class:	Design Error
CVE:	CVE-2001-0572
Remote:	Yes
Local:	No
Published:	Mar 03 2001 12:00AM
Updated:	Sep 09 2011 05:00PM
Credit:	Solar Designer and Dug Song of The Openwall Project and Dawn Xiaodong Song, David Wagner, and Xuqing Tian of the University of California
Vulnerable:	OpenSSH OpenSSH 2.9 p1 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 OpenSSH OpenSSH 2.9 + FreeBSD FreeBSD 4.6 -RELEASE + FreeBSD FreeBSD 4.6 + FreeBSD FreeBSD 4.5 -RELEASE + FreeBSD FreeBSD 4.5 OpenSSH OpenSSH 2.5.2 - Caldera OpenUnix 8.0 - Caldera UnixWare 7.1.1 - Wirex Immunix OS 6.2 OpenSSH OpenSSH 2.5.1 + NetBSD NetBSD 1.5.1 + S.u.S.E. Linux 7.3 + S.u.S.E. Linux 7.2 + S.u.S.E. Linux 7.1 + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Firewall on CD + S.u.S.E. SuSE eMail Server III - SCO Open Server 5.0.6 a - SCO Open Server 5.0.6 - SCO Open Server 5.0.5 - SCO Open Server 5.0.4 - SCO Open Server 5.0.3 - SCO Open Server 5.0.2 - SCO Open Server 5.0.1 - SCO Open Server 5.0 + SuSE SUSE Linux Enterprise Server 7 OpenSSH OpenSSH 2.5 OpenSSH OpenSSH 2.3 - S.u.S.E. Linux 7.0 sparc - S.u.S.E. Linux 7.0 ppc - S.u.S.E. Linux 7.0 i386 - S.u.S.E. Linux 7.0 alpha - S.u.S.E. Linux 6.4 ppc - S.u.S.E. Linux 6.4 i386 - S.u.S.E. Linux 6.4 alpha OpenSSH OpenSSH 2.2 .0p1 OpenSSH OpenSSH 2.2 + Conectiva Linux 6.0 + NetBSD NetBSD 1.5 OpenSSH OpenSSH 2.1.1 + Conectiva Linux 5.1 + S.u.S.E. Linux 7.0 sparc + S.u.S.E. Linux 7.0 ppc + S.u.S.E. Linux 7.0 i386 + S.u.S.E. Linux 7.0 alpha OpenSSH OpenSSH 2.1
Not Vulnerable:	OpenSSH OpenSSH 2.9 p2 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Conectiva Linux 8.0 + Conectiva Linux 7.0 + Conectiva Linux 6.0 - Conectiva Linux 5.0 - Conectiva Linux graficas - Conectiva Linux ecommerce + FreeBSD FreeBSD 4.4 -RELENG + HP Secure OS software for Linux 1.0 + Immunix Immunix OS 7.0 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Linux Mandrake 8.1 + MandrakeSoft Linux Mandrake 8.0 ppc + MandrakeSoft Linux Mandrake 8.0 + MandrakeSoft Linux Mandrake 7.2 + MandrakeSoft Linux Mandrake 7.1 + MandrakeSoft Single Network Firewall 7.2 + RedHat Linux 7.2 + RedHat Linux 7.1 + RedHat Linux 7.0 - S.u.S.E. Linux 7.3 sparc - S.u.S.E. Linux 7.3 ppc - S.u.S.E. Linux 7.3 i386 - S.u.S.E. Linux 7.2 i386 - S.u.S.E. Linux 7.1 x86 - S.u.S.E. Linux 7.1 sparc - S.u.S.E. Linux 7.1 ppc - S.u.S.E. Linux 7.1 alpha + Sun Cobalt RaQ 550

OpenSSH Ciphersuite Specification Information Disclosure Weakness

OpenSSH is prone to a security weakness that may allow attackers to downgrade the ciphersuite.

Successfully exploiting this issue in conjunction with other latent vulnerabilities may allow attackers to gain access to sensitive information that may aid in further attacks.

Releases prior to OpenSSH 2.9p2 are vulnerable.

OpenSSH Ciphersuite Specification Information Disclosure Weakness

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSH Ciphersuite Specification Information Disclosure Weakness

Solution:
Updates are available. Please see the references for more information.

OpenSSH Ciphersuite Specification Information Disclosure Weakness

References:

• OpenSSH Homepage (OpenSSH)
  
• Vulnerability Note VU#596827 (US-CERT)