[Dshield] Cisco Security Advisory: SSH Malformed PacketVulnerabil ities

Scott Melnick smelnick at water.com
Wed Oct 12 20:01:23 GMT 2005


>Although this advisory is over 3 years old, I'm not sure why it
>also states:

>"Last Updated 2005 Oct 12 17:00 GMT"

At the very bottom of the advisory shows a revision history.

Weds Oct 12 17:00:00 UTC 2005 	
Added Cisco ONS product references to the Affected Products, Details,
Sofware Versions and Fixes, and Workarounds sections.


Scott Melnick
Security Guy


-----Original Message-----
From: list-bounces at lists.dshield.org
[mailto:list-bounces at lists.dshield.org] On Behalf Of Fergie (Paul
Ferguson)
Sent: Wednesday, October 12, 2005 3:22 PM
To: list at lists.dshield.org
Subject: Re: [Dshield] Cisco Security Advisory: SSH Malformed
PacketVulnerabil ities

Also:

Although this advisory is over 3 years old, I'm not sure why it
also states:

"Last Updated 2005 Oct 12 17:00 GMT"

(?)

- ferg


-- "Fergie (Paul Ferguson)" <fergdawg at netzero.net> wrote:

Via the Cisco website.

[snip]

Certain Cisco products containing support for the Secure Shell (SSH)
server are vulnerable to a Denial of Service (DoS) if the SSH server is
enabled on the device. A malformed SSH packet directed at the affected
device can cause a reload of the device. No authentication is necessary
for the packet to be received by the affected device. The SSH server in
Cisco IOS(r) is disabled by default.

Cisco will be making free software available to correct the problem as
soon as possible.

The malformed packets can be generated using the SSHredder test suite
from Rapid7, Inc. Workarounds are available. The Cisco PSIRT is not
aware of any malicious exploitation of this vulnerability.

This advisory is available at
http://www.cisco.com/warp/public/707/ssh-packet-suite-vuln.shtml

[snip]

- ferg


--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg at netzero.net or fergdawg at sbcglobal.net
 ferg's tech blog: http://fergdawg.blogspot.com/







More information about the list mailing list