SB2017040408 - MitM attack in Go Crypto

Description

This security bulletin contains information about 1 vulnerability.

1) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2017-3204)

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to Go Crypto library does not verify host keys. A remote attacker can perform MitM attack.

Remediation

Install update from vendor's website.

References

• https://bridge.grumpy-troll.org/2017/04/golang-ssh-security/
• https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d96367750991
• https://github.com/golang/go/issues/19767
• https://godoc.org/golang.org/x/crypto/ssh