Summary

• Four different Cisco product lines are susceptible to multiple vulnerabilities discovered in the Secure Shell (SSH) protocol version 1.5. These issues have been addressed, and fixes have been integrated into the Cisco products that support this protocol.

  By exploiting the weakness in the SSH protocol, it is possible to insert arbitrary commands into an established SSH session, collect information that may help in brute force key recovery, or brute force a session key.

  Affected product lines are:

  • All devices running Cisco IOSŪ software supporting SSH. This includes routers and switches running Cisco IOS software.
    
  • Catalyst 6000 switches running CatOS.
    
  • Cisco PIX Firewall.
    
  • Cisco 11000 Content Service Switch family.
    

  No other Cisco products are vulnerable. It is possible to mitigate this vulnerability by preventing, or having control over, the interception of SSH traffic.

  Cisco IOS is not vulnerable to any of known exploits that are currently used to compromise UNIX hosts. For the warning regarding increased scanning activity for hosts running SSH consult CERT/CC

  This advisory will be posted at: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20010627-ssh.

Affected Products

• Vulnerable Products

  The following table depicts the affected products categories.

  Product Category	CRC-32 check	Traffic analysis	Key recovery
  IOS	Vulnerable CSCdt96253	Vulnerable CSCdt57231	Vulnerable CSCdu37371
  PIX	Vulnerable CSCdt73353	Not vulnerable	Not vulnerable
  VPN3000	Not vulnerable	Not vulnerable	Not vulnerable
  Catalyst 6000	Vulnerable CSCdt72996	Vulnerable CSCdt55357	Not vulnerable
  CSS 11000	Vulnerable CSCdv34668	Vulnerable CSCdv34676	Vulnerable CSCdv34679

  Per product category, the following software releases are vulnerable:

  IOS	All 12.0 and later releases that include support for SSH.
  PIX	5.2(5) and 5.3.(1)
  CatOS	6.2(0.110)
  VPN3000	Not vulnerable
  CSS 11000	All WebNS releases prior, but excluding, versions: R4.01 B42s, R4.10 B22s, R5.0 B11s, R5.01 B6s

  Products Confirmed Not Vulnerable

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• An implementation of SSH in multiple Cisco products are vulnerable to three different vulnerabilities. These vulnerabilities are:

  • CRC-32 integrity check vulnerability -- This vulnerability has been described in a CORE SDI S.A. paper entitled "An attack on CRC-32 integrity checks of encrypted channels using CBC and CFB modes", which can be found at http://www.core-sdi.com/soft/ssh/ssh.pdf.
    In order for this attack to succeed, an attacker must possess one or two known ciphertext/plaintext pairs. This should not be difficult since every session starts with a greeting screen which is fixed and which can be determined. This also implies that an attacker must be somewhere along the session path in order to be able to sniff the session and collect corresponding ciphertext.
    For further technical details, see http://www.core-sdi.com/soft/ssh/ssh.pdf.
    While fixing this vulnerability, we have not made the implementation mistake described by VU#945216 (see http://www.kb.cert.org/vuls/id/945216) which is being actively exploited.
    
  • Traffic analysis -- This issue has been described in an analysis jointly made by Dug Song and Solar Designer. It can be found at: http://www.openwall.com/advisories/OW-003-ssh-traffic-analysis.txt, and is entitled "Passive Analysis of SSH (Secure Shell) Traffic".
    To exploit this vulnerability, an attacker must be able to capture packets. When sending a packet using the SSH protocol, it is padded to the next 8-byte boundary, but the exact length of the data (without the padding) is sent unencrypted.
    The timing between packets may yield additional information, such as the relative position of a letter on the keyboard, but that depends on overall jitter in the network and the typing habits of the person.
    For additional information, please see http://www.openwall.com/advisories/OW-003-ssh-traffic-analysis.txt.
    
  • Key recovery in SSH protocol 1.5 -- This has been discovered by CORE SDI S.A. and the paper describing it can be viewed at http://www.securityfocus.com/archive/1/161150. The subject line is "SSH protocol 1.5 session key recovery vulnerability".
    In order to exploit this vulnerability, an attacker must be able to sniff the SSH session and be able to establish a connection to the SSH server. In order to recover the server key, an attacker must perform an additional 2^20+2^19=1572864 connections. Since the key has a lifespan of about an hour, this means that an attacker must perform around 400 connections per second.
    For further details, please see http://www.securityfocus.com/archive/1/161150.
    

Workarounds

• There are no workarounds for these vulnerabilities.

Fixed Software

• The following software releases contain fixes for all vulnerabilities.

  For CSS 11000 family, all vulnerabilities are fixed in the following software releases:

  WebNS

  R4.01 B42s, R4.10 B22s, R5.0 B11s, R5.01 B6s

  For Catalyst 6000 switches, all vulnerabilities are fixed in the following CatOS releases.

  CatOS

  6.1(2.13), 6.2(0.111) and 6.3(0.7)PAN

  Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the "Rebuild", "Interim", and "Maintenance" columns. A device running any release in the given train that is earlier than the release in a specific column (less than the earliest fixed release) is known to be vulnerable, and it should be upgraded at least to the indicated release or a later version (greater than the earliest fixed release label).

  When selecting a release, keep in mind the following definitions:

  • Maintenance
    Most heavily tested and highly recommended release of any label in a given row of the table.
    
  • Rebuild
    Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific defect. Although it receives less testing, it contains only the minimal changes necessary to effect the repair.
    
  • Interim
    Built at regular intervals between maintenance releases and receives less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability, and interim images should be upgraded to the next available maintenance release as soon as possible. Interim releases are not available through manufacturing, and usually they are not available for customer download from CCO without prior arrangement with the Cisco TAC.
    

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance as shown in the following section.

  More information on Cisco IOS software release names and abbreviations is available at http://www.cisco.com/warp/public/620/1.html.

  For PIX Firewall software, use the following table to determine affected and fixed software releases.

  Train	Description of Image or Platform	Availability of Fixed Releases*
  5.x-based Releases		Rebuild	Interim**	Maintenance
  5.2	Early Deployment (ED) for all platforms		5.2(5)203 Available through TAC	5.2.(6) Available in August
  5.3	Early Deployment (ED) for all platforms		5.3(1)202 Available through TAC	5.3.(2) Available in August
  6.x-based Releases		Rebuild	Interim**	Maintenance
  6.0	Early Deployment (ED) for all platforms			6.0(1) Available

  For Cisco IOS software, use the following table to determine affected and fixed software releases.

  Train	Description of Image or Platform	Availability of Fixed Releases*
  12.0-based Releases		Rebuild	Interim**	Maintenance
  12.0S	Core/ISP support: GSR, RSP, c7200			12.0(20)S 2001-November
  12.1-based Releases		Rebuild	Interim**	Maintenance
  12.1	General deployment release for all platforms	SSH not supported
  12.1AA	Dial support	SSH not supported
  12.1CX	Core/ISP support: GSR, RSP, c7200	SSH not supported
  12.1DA	xDSL support: 6100, 6200	SSH not supported
  12.1DB	Cisco IOS Software Release 12.1(1)DB supports Cisco?s 6400 Universal Access Concentrator
  12.1DC	Cisco IOS Software Release 12.1(1)DC supports Cisco?s 6400 Universal Access Concentrator
  12.1E	Core/ISP support: GSR, RSP, c7200			12.1(8a)E 2001-Jul-09
  12.1EC	12.1EC is being offered to allow early support of new features on the uBR7200 platform, as well as future support for new Universal Broadband Router headend platforms.		12.1(6.5)EC3
  12.1EX	Catalyst 6000 support				12.1(8a)E 2001-Jul-09
  12.1EY	Cat8510c, Cat8510m, Cat8540c, Cat8540m, LS1010				12.1(6)EY
  12.1EZ	Early Deployment (ED): special image	12.1(6)EZ2
  12.1T	Early Deployment(ED): VPN, Distributed Director, various platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XA	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XB	Early Deployment (ED): limited platforms
  12.1XC	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XD	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XE	Early Deployment (ED): limited platforms
  12.1XF	Early Deployment (ED): 811 and 813 (c800 images)	12.1(2)XF4 2001-July-09
  12.1XG	Early Deployment (ED): 800, 805, 820, and 1600	12.1(2)XF4 2001-July-09
  12.1XH	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XI	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XJ	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.1(5)YB4
  12.1XK	Early Deployment (ED): limited platforms	SSH not supported
  12.1XL	Early Deployment (ED): limited platforms	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XM	Short-lived early deployment release	12.1(4)XM4 2001-June-27
  12.1XP	Early Deployment (ED): 1700 and SOHO	12.1(3)XP4
  12.1XQ	Short-lived early deployment release	Not Scheduled
  		Upgrade recommended to 12.2(1b)
  12.1XR	Short-lived early deployment release	12.1(5)XR2
  12.1XS	Short-lived early deployment release	12.1(5)XS2 2001-July
  12.1XT	Early Deployment (ED): 1700 series	12.1(3)XT3
  12.1XU	Early Deployment (ED): limited platforms	12.1(5)XU1
  12.1XV	Short-lived early deployment release	12.1(5)XV3 2001-July
  12.1XW	Short-lived early deployment release	SSH not supported
  12.1XX	Short-lived early deployment release	SSH not supported
  12.1XY	Short-lived early deployment release	12.1(5)XY6 2001-July
  12.1XZ	Short-lived early deployment release	SSH not supported
  12.1YA	Short-lived early deployment release	Not Scheduled
  		Upgrade recommended to 12.2(2)XB 2001-August
  12.1YB	Short-lived early deployment release	12.1(5)YB4
  12.1YC	Short-lived early deployment release	12.1(5)YC1
  12.1YD	Short-lived early deployment release	12.1(5)YD2 2001-June-25
  12.1YF	Short-lived early deployment release	12.1(5)YF2
  12.2-based Releases		Rebuild		Interim**	Maintenance
  12.2	General deployment release for all platforms	12.2(1b)		12.2(1.1)	12.2(3) 2001-August
  12.2T	General deployment release for all platforms			12.2(2.2)T
  12.2XA	SPLOB				12.2(2)XA 2001-July-02
  12.2XD	Short-lived early deployment release	12.2(1)XD1
  12.2XE	Short-lived early deployment release				12.2(1)XE
  12.2XH	Short-lived early deployment release				12.2(1)XH 2001-June-25
  12.2XQ	Short-lived early deployment release				12.2(1)XQ 2001-June-23
  Notes
  * All dates are estimates and subject to change. ** Interim releases are subjected to less rigorous testing than regular maintenance releases, and may have serious bugs.

Exploitation and Public Announcements

• All three vulnerabilities are publicly known. Please see the Details section for the original announcements.

  The Cisco PSIRT is not aware of malicious use of the vulnerabilities described in this advisory.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20010627-ssh

Revision History

• Revision 1.6	2001-Nov-12	Updated information regarding vulnerability of UNIX hosts in Summary section and implementation mistake VU#945216 in Details section
  Revision 1.5	2001-Oct-05	Updated SSH protocol version information in Summary section
  Revision 1.4	2001-Oct-04	Updated maintenance release version and date for Cisco IOS software 12.0S train in Software Versions and Fixes section
  Revision 1.3	2001-Sept-20	Updated information regarding CSS in Summary, Affected Products and Software Versions and Fixes sections
  Revision 1.2	2001-Aug-08	Updated url in Details section
  Revision 1.1	2001-June-28	Updated software availability date; added Traffic Analysis author
  Revision 1.0	2001-June-27	Initial public release

  Show Less