Summary

• New vulnerabilities in the OpenSSH implementation for SSH servers have been announced.

  An affected network device, running an SSH server based on the OpenSSH implementation, may be vulnerable to a Denial of Service (DoS) attack when an exploit script is repeatedly executed against the same device. There are workarounds available to mitigate the effects of these vulnerabilities.

  This advisory will be posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh.

Affected Products

• This section provides details on affected products.

  Vulnerable Products

  The following products, have their SSH server implementation based on the OpenSSH code, and are affected by the OpenSSH vulnerabilities.

  • Cisco Catalyst Switching Software (CatOS)
    Cisco's various Catalyst family of switches run CatOS-based releases or IOS-based releases.
    IOS-based releases are not vulnerable.
    All K9 (crypto) images in 6.x, 7.x, and 8.x release trains are affected by these vulnerabilities. CatOS releases 2.x, 3.x, 4.x and 5.x are not vulnerable as they do not have SSH support.
    The following Cisco Catalyst Switches are vulnerable:
    - Catalyst 6000 series
    - Catalyst 5000 series
    - Catalyst 4000 series
    - Catalyst 2948G, 2980G, 2980G-A, 4912G - use Catalyst 4000 series code base
    To determine your software revision, type show version command at the command line prompt.
    
  • Cisco Secure Intrusion Detection System (NetRanger) appliance
    The following devices (running software version 3.0(1) through 4.1(1)) are vulnerable:
    - IDS-42xx appliances
    - NM-CIDS
    - WS-SVS-IDSM2
    
  • Cisco Network Analysis Modules (NAM) for the Cisco Catalyst 6000 and 6500 Series switches and Cisco 7600 Series routers
    The following devices that have applied the K9 crypto patch and have SSH enabled are vulnerable:
    - WS-X6380-NAM, running software version 2.1(2) or 3.1(1a)
    - WS-SVC-NAM-1, running software version 2.2(1a) or 3.1(1a)
    - WS-SVC-NAM-2, running software version 2.2(1a) or 3.1(1a)
    
  • CiscoWorks 1105 Hosting Solution Engine (HSE)
    
  • CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)
    
  • Cisco Content Service CSS 11000 Switch series
    
  • Cisco Application & Content Networking Software (ACNS)
    
  • BTS 10200 Softswitch
    
  • Cisco GSS 4480 Global Site Selector
    
  • Cisco SN 5428 Storage Router
    
  • Cisco PGW 2200 Softswitch (formerly known as Cisco VSC 3000 and as Cisco SC 2200)
    

  Cisco has not released code with SSH for the SN5420 storage router.

  Products Confirmed Not Vulnerable

  The following products, which incorporate a SSH server, have been confirmed to be not vulnerable to the OpenSSH vulnerabilities.

  • Cisco IOS, both SSH version 1.5 and SSH version 2.0
    
  • Cisco Secure Intrusion Detection System Catalyst Module (IDSM)—model number WS-X6381-IDS
    
  • Cisco PIX Firewall
    
  • Cisco Catalyst 6000 FireWall Service Module (FWSM)
    
  • Cisco VPN 3000 Concentrators and Cisco VPN 5000 Concentrators
    
  • Cisco MDS 9000 Series Multilayer Switches
    

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• The buffer size or the number of channels in the fixed code is now correctly incremented only after a successful allocation where as initially they were being set before an allocation. Upon an allocation failure, which could be externally triggered, memory contents would be incorrectly erased by the cleanup process. This would result in a corruption of the memory which would eventually lead to a crash for the process using that memory.

  Portable OpenSSH version (not OpenBSD version) 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM authentication code. These vulnerabilities are not known to affect any Cisco products.

  Please note, the SSH server code under Cisco IOS has other vulnerabilities as documented by http://www.cisco.com/warp/public/707/ssh-packet-suite-vuln.shtml which may be triggered by the code written to exploit the OpenSHH vulnerabilities.

  • Cisco Catalyst Switching Software (CatOS)—This vulnerability is documented as Bug ID CSCec33092 ( registered customers only) .
    If SSH is disabled the Catalyst switch will not be vulnerable to these vulnerabilities. CatOS K9 (crypto) release 6.1 was the first CatOS release which incorporated the SSH feature.
    To verify if SSH has been configured on the switch type show crypto key. If this shows you the RSA key then SSH has been configured and enabled on the switch. To remove the crypto key type clear crypto key RSA and this will disable the SSH server on the switch.
    
  • Cisco Secure Intrusion Detection System (NetRanger) appliance—This vulnerability is documented as Bug IDs CSCec32508 ( registered customers only) and CSCec37419 ( registered customers only)
    
  • Cisco Network Analysis Modules (NAM)—This vulnerability is documented as Bug ID CSCec35975 ( registered customers only) .
    To verify if the K9 crypto patch is installed, type the show patch command. To verify if SSH access has been enabled using the exsession on ssh command, type the show ip command, and if the line starting with "SSH:" shows "Enabled" you are vulnerable.
    
  • CiscoWorks 1105 Hosting Solution Engine (HSE)—This vulnerability is documented as Bug IDs CSCec34502 ( registered customers only) and CSCec34522 ( registered customers only) .
    
  • CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)—This vulnerability is documented as Bug IDs CSCec33254 ( registered customers only) and CSCec34521 ( registered customers only) .
    
  • Cisco Content Service CSS11000 Switch series—Cisco WebNS 5.x, 6.x and 7.x are affected. This vulnerability is documented as Bug ID CSCec35690 ( registered customers only) .
    
  • Cisco Application & Content Networking Software (ACNS)—All versions affected. This vulnerability is documented as Bug ID CSCec32387 ( registered customers only) .
    
  • BTS 10200 Softswitch—All releases prior to RLS 3.5.3 are affected. A new openssh package has been made available.
    
  • Cisco GSS 4480 Global Site Selector—All versions affected. This vulnerability is documented as Bug ID CSCec32245 ( registered customers only) .
    
  • Cisco SN 5428 Storage Router—
    Vulnerable versions are:
    - SN5428-2.5.1-K9
    - SN5428-3.2.1-K9
    - SN5428-3.2.2-K9
    - SN5428-3.3.1-K9
    - SN5428-3.3.2-K9
    - SN5428-2-3.3.1-K9
    - N5428-2-3.3.2-K9
    This vulnerability is documented as Bug ID CSCec32301 ( registered customers only) . For more information on the SN 5428 please refer to http://www.cisco.com/en/US/products/hw/ps4159/ps2160/index.html.
    
  • Cisco PGW 2200 Softswitch—The following PGW 2200 components that have applied the CSCOk9000 crypto package found in PGW Restricted Software 1.0(1) are vulnerable:
    - PGW Host platform running MGC application software, and optionally MNM-PT application software
    - HSI host platform running HSI application software
    - BAMS platform running BAMS application software
    - A separate node management platform running the MNM-PT application software
    

Workarounds

• The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code as soon as it is available.

  • The following workarounds can be implemented for CatOS based switches.
    - Apply IP Permit List for SSH to enable access to the switch's management interface only from the network management workstations.
    For instructions on how to do this, please refer to http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_6_1/config/ip_perm.htm.
    - On the Catalyst 6000 series switches, if the VLAN Access Control List (ACL) (VACL) feature is available in the code base, you can use VACLs instead of the IP Permit List workaround above.
    For instructions on how to do this, please refer to http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/6.x/configuration/guide/acc_list.html.
    - mplement the best practice to assign all of the management interfaces of all the switches in the network to a different VLAN, and apply appropriate ACLs on the router switching between the VLANs.
    For an example, see http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/6.x/configuration/guide/acc_list.html
    - Apply ACLs on routers / switches / firewalls in front of the vulnerable switches such that traffic destined for the SSH TCP port 22 on the vulnerable switches is only allowed from the network management workstations.
    For an example, see http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/6.x/configuration/guide/acc_list.html.
    
  • To turn off SSH access on the Cisco Network Analysis Modules (NAM), type the exsession off ssh command.
    
  • Wherever possible, restrict access to the SSH server on the network device. Allow access to the network device only from trusted workstations by using ACLs / MAC filters that are available on the affected platforms.
    

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

  • Cisco Catalyst Switching Software (CatOS)—CatOS release schedule:
    - 6.4(7) for Catalyst 4000/5000/6000 series switches due out on November 12, 2003
    - 7.6(3a) for Catalyst 4000 series switches due out on September 30, 2003
    - 7.6(3a) for Catalyst 6000 series switches due out on September 26, 2003
    - 8.1(3) for Catalyst 6000 series switches due out on October 13, 2003
    - 8.2(1)GLX for Catalyst 4000 series switches due out on September 25, 2003
    - 8.2(1) for Catalyst 6000 series switches due out in 4th Quarter 2003
    Software upgrades can be performed via the console interface. Please refer to software release notes for instructions.
    
  • Cisco Secure Intrusion Detection System (NetRanger) appliance—Software version 4.1(2), due out end of October, will have the fix. Software version 3.1(5) will have the fix for software version 3.1; release date to be determined.
    
  • Cisco Network Analysis Modules (NAM)—An updated k9 crypto patch for the 3.1 images, due out middle of October, will have the fix.
    
  • CiscoWorks 1105 Hosting Solution Engine (HSE)—Software version 1.7.2, due out October 10, will have the fix.
    
  • CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)—Release date to be determined.
    
  • Cisco Content Service CSS11000 Switch series—Software versions 5.0.3.10s, 6.10.1.8s, 7.10.3.11s and 7.20.1.10s, due out October 3, will have the fix.
    
  • Cisco Application & Content Networking Software (ACNS)-Software versions 5.1 and 5.0.7 will have the fix. Software version 5.0.7 is due out September 30.
    
  • BTS 10200 Softswitch-A new openssh package has been made available. Please contact your Cisco SE for more information.
    
  • Cisco GSS 4480 Global Site Selector—Software version 1.1(0) code, due out on October 10, will have the fix.
    
  • Cisco SN 5428 Storage Router—Software version 3.4.1, due out end of September, will have the fix for the SN 5428 and SN 5428-2.
    
  • Cisco PGW 2200 Softswitch—Software version 1.0(2), due out end of November, will have the fix.
    

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any malicious use of the vulnerabilities described in this advisory, at this time.

  These vulnerabilities have also been documented by CERT/CC at http://www.cert.org/advisories/CA-2003-24.html .

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh

Revision History

• Revision 1.6	2003-November-07	Added Cisco PGW 2200 Softswitch as a vulnerable product. Added 8.1(3) as a fixed release for CatOS.
  Revision 1.5	2003-September-27	Added not vulnerable to Portable OpenSSH version in the details section. Added ACNS and BTS10200 as vulnerable. Added 5.x as affected release for CSS11000. Updated fix information for NAM.
  Revision 1.4	2003-September-23	Added CatOS release schedule in Software Versions and Fixes.
  Revision 1.3	2003-September-19	Added Cisco Content Service CSS11000 Switch series and Cisco Network Analysis Modules (NAM) as being affected.
  Revision 1.2	2003-September-18	Added an additional workaround for the CatOS in the Workaround section.
  Revision 1.1	2003-September-18	Added CatOS versions, Cisco Secure Intrusion Detection System (NetRanger) appliance, and Cisco GSS 4480 Global Site Selector to the Affected Products section; and Cisco Secure Intrusion Detection System Catalyst Module (IDSM) to the not vulnerable list. Added Cisco Secure Intrusion Detection System (NetRanger) appliance, and Cisco GSS 4480 Global Site Selector to the Details section, and added Bug IDs for the products. Added Cisco Secure Intrusion Detection System (NetRanger) appliance to the Software Versions and Fixes section, and added upcoming fixes for the products.
  Revision 1.0	2003-September-17	Initial public release.

  Show Less