CVE-2008-5161: OpenSSH CBC plaintext recovery
Bug #379329 reported by
Johannes Hessellund
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
openssh (Ubuntu) |
Fix Released
|
Low
|
Colin Watson | ||
Intrepid |
Invalid
|
Low
|
Unassigned | ||
Jaunty |
Won't Fix
|
Low
|
Unassigned | ||
Karmic |
Won't Fix
|
Low
|
Unassigned | ||
Lucid |
Fix Released
|
Low
|
Colin Watson |
Bug Description
According to: http://
openssh prior to version 5.2 has security flaw, allowing man in the middle attacks.
More info:
http://
http://
http://
Please upgrade version to 5.2 and backport to at least Hardy, but preferably also to Dapper !
CVE References
visibility: | private → public |
Changed in openssh (Ubuntu): | |
importance: | Undecided → Low |
status: | New → Confirmed |
summary: |
- Security flaw in openSSH prior to 5.2 + CVE-2008-5161: OpenSSH CBC plaintext recovery |
Changed in openssh (Ubuntu): | |
assignee: | nobody → Colin Watson (cjwatson) |
status: | Confirmed → Fix Committed |
Changed in openssh (Ubuntu Karmic): | |
status: | New → Confirmed |
importance: | Undecided → Low |
Changed in openssh (Ubuntu Intrepid): | |
status: | New → Triaged |
importance: | Undecided → Low |
Changed in openssh (Ubuntu Jaunty): | |
importance: | Undecided → Low |
Changed in openssh (Ubuntu Intrepid): | |
assignee: | nobody → Ubuntu Security Team (ubuntu-security) |
Changed in openssh (Ubuntu Jaunty): | |
status: | New → Won't Fix |
Changed in openssh (Ubuntu Karmic): | |
status: | Confirmed → Won't Fix |
To post a comment you must log in.
It appears that there's no need to backport a new version of OpenSSH. As you can see here: http:// www.openssh. com/txt/ cbc.adv you only need to add this line:
Ciphers aes128- ctr,aes256- ctr,arcfour256, arcfour, aes128- cbc,aes256- cbc
to ssh_config and sshd_config and restart the daemon. www.openssh. com/txt/ cbc.adv)
Also:
The severity is considered to be potentially HIGH due to the
32 bits of plaintext that can be recovered. However, the
likelihood of a successful attack is considered LOW.
(http://