OpenSSH vulnerabilities

[Ian]

Hi,

I was using NMAP to scan my Ubuntu server and it listed some vulnerabilities in OpenSSH. It also came up with exploits against these vulnerabilities.

On my home network, I have several computers that I use for various purposes; a Ubuntu 20.04 LTS computer and Kali Linux computer being the subject for this email. I wanted to test if I had any security issues on my Ubuntu computer so I was doing some scans on it from my Kali computer. I did a scan with NMAP and it produced some vulnerabilities in OpenSSH and what exploits to use. Here is some info on my computers and the NMAP command that I used:

~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.2 LTS
Release: 20.04
Codename: focal

─$ lsb_release -a
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2021.1
Codename: kali-rolling

~$ ssh -V
OpenSSH_8.2p1 Ubuntu-4ubuntu0.2, OpenSSL 1.1.1f 31 Mar 2020

~$ apt-cache policy ssh
ssh:
  Installed: (none)
  Candidate: 1:8.2p1-4ubuntu0.2
  Version table:
     1:8.2p1-4ubuntu0.2 500
        500 http://ca.archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
        500 http://ca.archive.ubuntu.com/ubuntu focal-security/main amd64 Packages
     1:8.2p1-4 500
        500 http://ca.archive.ubuntu.com/ubuntu focal/main amd64 Packages

─$ sudo nmap -sV --script vuln 192.168.0.10
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-26 17:26 PDT
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 192.168.0.10
Host is up (0.00017s latency).
Not shown: 995 filtered ports
PORT STATE SERVICE VERSION
20/tcp closed ftp-data
21/tcp closed ftp
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| vulners:
| cpe:/a:openbsd:openssh:8.2p1:
| EDB-ID:21018 10.0 https://vulners.com/exploitdb/EDB-ID:21018 *EXPLOIT*
| CVE-2001-0554 10.0 https://vulners.com/cve/CVE-2001-0554
| CVE-2020-15778 6.8 https://vulners.com/cve/CVE-2020-15778
| CVE-2020-12062 5.0 https://vulners.com/cve/CVE-2020-12062
| CVE-2021-28041 4.6 https://vulners.com/cve/CVE-2021-28041
| MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/ *EXPLOIT*
| MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/ *EXPLOIT*
| MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/ *EXPLOIT*
| MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/ *EXPLOIT*
| MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/ *EXPLOIT*
| CVE-2020-14145 4.3 https://vulners.com/cve/CVE-2020-14145
|_ MSF:AUXILIARY/SCANNER/SSH/FORTINET_BACKDOOR/ 0.0 https://vulners.com/metasploit/MSF:AUXILIARY/SCANNER/SSH/FORTINET_BACKDOOR/ *EXPLOIT*
80/tcp open http Apache httpd
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Apache
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
443/tcp open ssl/http Apache httpd
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Apache
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_sslv2-drown:
MAC Address: 00:15:C5:F6:5D:94 (Dell)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 80.86 seconds

Thanks,
Ian

[Seth Arnold (seth-arnold)]

Hello Ian, thanks for the bug.

Have you had any success with any of the exploits?

Most of these sorts of tools that do "banner detection" assume everyone builds all their programs from source code themselves, and thus aren't very useful in the real world. The first CVE listed is from 2001, which predates Ubuntu by some margin.

Here's our current status on OpenSSH issues: https://ubuntu.com/security/cve?q=&package=openssh&priority=&version=&status=

There's several we've chosen to ignore; there's one we've rated as low priority, and will address if there's a medium priority or higher issue in the future: https://ubuntu.com/security/CVE-2020-14145

Thanks

[Ian (ianc01)]

Hi,

Thanks for looking into this; I haven't tried any of the exploits yet. I will try over the next day or two. I was doing the scan to a) learn about the tools hackers would use, and b) to use those tools to try to make my network more secure.

I know some of the tools can give false-positives and was leaning in that direction. I was looking at the OpenSSH website and they listed the newest version as OpenSSH 8.6 and figured it had to do with the banner detection.

I will try the exploits that it suggests and I will update on if they work or not. Hopefully I can get it to you before the weekend.

Thanks for looking into it and letting me know.

Ian

[Ian (ianc01)]

Hello,

Just an update, Metasploit must have been giving false-positives. I used the exploits Metasploit suggested against the vulnerabilities it listed. Everything has either failed or came back as unexplainable. I would post but it would be rather long and since everything has failed so far, I will only keep testing and send something if I find it.

I also scanned my Ubuntu system and it came up with "vulnerabilities" and "exploits" for other services that I have yet to test. If I do come across anything, I will post another bug.

Thanks for your help and time into looking at this.

Ian

[Seth Arnold (seth-arnold)]

Great, thanks Ian.