CVE-2008-5161
At a glance
- Source
- NVD
- EPSS
- EPSS 18.55 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
Weaknesses (CWE)
- CWE-329 — Generation of Predictable IV with CBC Mode
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- http://openssh.org/txt/cbc.adv
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1
- http://www.securityfocus.com/bid/32319
- http://secunia.com/advisories/33121
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- http://osvdb.org/49872
- http://secunia.com/advisories/33308
- http://rhn.redhat.com/errata/RHSA-2009-1287.html
- http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
- http://www.securitytracker.com/id?1021382
- https://kc.mcafee.com/corporate/index?page=content&id=SB10163
- http://osvdb.org/50036
- http://secunia.com/advisories/32833
- http://secunia.com/advisories/36558
- http://osvdb.org/50035
- http://www.ssh.com/company/news/article/953/
- http://www.securitytracker.com/id?1021235
- http://secunia.com/advisories/34857
- http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
- http://support.attachmate.com/techdocs/2398.html
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html
- http://www.vupen.com/english/advisories/2008/3173
- http://www.securityfocus.com/archive/1/498579/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46620
- http://secunia.com/advisories/32740
- http://www.vupen.com/english/advisories/2009/1135
- http://secunia.com/advisories/32760
- http://www.vupen.com/english/advisories/2009/3184
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://www.securitytracker.com/id?1021236
- https://kc.mcafee.com/corporate/index?page=content&id=SB10106
- http://marc.info/?l=bugtraq&m=125017764422557&w=2
- http://isc.sans.org/diary.html?storyid=5366
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
- http://www.vupen.com/english/advisories/2008/3409
- http://www.vupen.com/english/advisories/2008/3172
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279
- http://www.securityfocus.com/archive/1/498558/100/0/threaded
- http://support.apple.com/kb/HT3937
- http://www.kb.cert.org/vuls/id/958563
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2008-5139
- GCVE · GCVE-0-2008-5161
CERT-FR advisories
- CERTFR-2022-AVI-916 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2012-AVI-594 — Multiples vulnérabilités dans IBM XIV Storage System · cert.ssi.gouv.fr
- CERTA-2009-AVI-487 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.5:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.2.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.1j:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.2j:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.5:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.6:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.7:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.8k:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.9k:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.6:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.7:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.8:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.9:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.10:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.11:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.0:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.0f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.1f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.2f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.3f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.1.0:*:*:*:*:*:*:*- +127 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |