CVE-2008-5161
En bref
- Source
- NVD
- EPSS
- EPSS 18.55 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
Faiblesses (CWE)
- CWE-329 — Génération d'un VI prévisible en mode CBC
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
- http://openssh.org/txt/cbc.adv
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1
- http://www.securityfocus.com/bid/32319
- http://secunia.com/advisories/33121
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- http://osvdb.org/49872
- http://secunia.com/advisories/33308
- http://rhn.redhat.com/errata/RHSA-2009-1287.html
- http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
- http://www.securitytracker.com/id?1021382
- https://kc.mcafee.com/corporate/index?page=content&id=SB10163
- http://osvdb.org/50036
- http://secunia.com/advisories/32833
- http://secunia.com/advisories/36558
- http://osvdb.org/50035
- http://www.ssh.com/company/news/article/953/
- http://www.securitytracker.com/id?1021235
- http://secunia.com/advisories/34857
- http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
- http://support.attachmate.com/techdocs/2398.html
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html
- http://www.vupen.com/english/advisories/2008/3173
- http://www.securityfocus.com/archive/1/498579/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46620
- http://secunia.com/advisories/32740
- http://www.vupen.com/english/advisories/2009/1135
- http://secunia.com/advisories/32760
- http://www.vupen.com/english/advisories/2009/3184
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://www.securitytracker.com/id?1021236
- https://kc.mcafee.com/corporate/index?page=content&id=SB10106
- http://marc.info/?l=bugtraq&m=125017764422557&w=2
- http://isc.sans.org/diary.html?storyid=5366
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
- http://www.vupen.com/english/advisories/2008/3409
- http://www.vupen.com/english/advisories/2008/3172
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279
- http://www.securityfocus.com/archive/1/498558/100/0/threaded
- http://support.apple.com/kb/HT3937
- http://www.kb.cert.org/vuls/id/958563
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | LOW 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2008-5139
- GCVE · GCVE-0-2008-5161
Avis du CERT-FR
- CERTFR-2022-AVI-916 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2015-AVI-431 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2012-AVI-594 — Multiples vulnérabilités dans IBM XIV Storage System · cert.ssi.gouv.fr
- CERTA-2009-AVI-487 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:openbsd:openssh:4.7p1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.0.5:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.2.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.1j:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.2j:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.5:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.6:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.7:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.8k:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.3.9k:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.4:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.6:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.7:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.8:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.9:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.10:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:4.4.11:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.0:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.0f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.1:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.1f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.2:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.2f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.3:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.0.3f:*:*:*:*:*:*:*cpe:2.3:a:ssh:tectia_client:5.1.0:*:*:*:*:*:*:*- +127 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |