Improper handling of exceptional conditions in OpenSSH - CVE-2008-5161

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU68362

Improper handling of exceptional conditions in OpenSSH - CVE-2008-5161

Published: October 17, 2022


Vulnerability identifier: #VU68362
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2008-5161
CWE-ID: CWE-755
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.


Affected software

OpenSSH
ProCurve 6120XG Blade Switch for Integrity Servers
ProCurve 6120XG
Session Smart Router
SAN Volume Controller and Storwize Family
Dell EMC PowerMax Embedded NAS (eNAS)

How to mitigate CVE-2008-5161

Install updates from vendor's website.

Session Smart Router - addressed in versions 5.4.7, 5.5.3
SAN Volume Controller and Storwize Family - addressed in versions 7.8.1.9, 8.1.3.5, 8.2.0.4, 8.2.1.2
Dell EMC PowerMax Embedded NAS (eNAS) - update to 8.1.15.24

External References

Related Security Bulletins