vulnwire
3.7low

CVE-2008-51611 exploit

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
3.7
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
18.6%
percentile 97%
Public exploits
1
Metasploit

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction (EPSS)

18.55% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.13.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA3.13.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD2.02.6AV:N/AC:H/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-329 Generation of Predictable IV with CBC Mode
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • openssh.org /txt/cbc.adv · x_refsource_CONFIRM, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-66-247186-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • securityfocus.com /bid/32319 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/33121 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • h20566.www2.hpe.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667 · x_refsource_CONFIRM, x_transferred
  • osvdb.org /49872 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/33308 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • rhn.redhat.com /errata/RHSA-2009-1287.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • cpni.gov.uk /Docs/Vulnerability_Advisory_SSH.txt · x_refsource_MISC, x_transferred
  • securitytracker.com /id?1021382 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • kc.mcafee.com /corporate/index?page=content&id=SB10163 · x_refsource_CONFIRM, x_transferred
  • osvdb.org /50036 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/32833 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/36558 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /50035 · vdb-entry, x_refsource_OSVDB, x_transferred
  • ssh.com /company/news/article/953/ · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id?1021235 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • secunia.com /advisories/34857 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • support.avaya.com /elmodocs2/security/ASA-2008-503.htm · x_refsource_MISC, x_transferred
  • support.attachmate.com /techdocs/2398.html · x_refsource_CONFIRM, x_transferred
  • rtpro.yamaha.co.jp /RT/FAQ/Security/CPNI957037.html · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2008/3173 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/498579/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/46620 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/32740 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2009/1135 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/32760 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2009/3184 · vdb-entry, x_refsource_VUPEN, x_transferred
  • kb.juniper.net /InfoCenter/index?page=content&id=JSA10705 · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id?1021236 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • kc.mcafee.com /corporate/index?page=content&id=SB10106 · x_refsource_CONFIRM, x_transferred
  • marc.info /?l=bugtraq&m=125017764422557&w=2 · vendor-advisory, x_refsource_HP, x_transferred
  • isc.sans.org /diary.html?storyid=5366 · x_refsource_MISC, x_transferred
  • lists.apple.com /archives/security-announce/2009/Nov/msg00000.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • vupen.com /english/advisories/2008/3409 · vdb-entry, x_refsource_VUPEN, x_transferred
  • vupen.com /english/advisories/2008/3172 · vdb-entry, x_refsource_VUPEN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securityfocus.com /archive/1/498558/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • support.apple.com /kb/HT3937 · x_refsource_CONFIRM, x_transferred
  • kb.cert.org /vuls/id/958563 · third-party-advisory, x_refsource_CERT-VN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.