OSVDB ID: 50036

Title: OpenSSH CBC Mode Chosen Ciphertext 32-bit Chunk Plaintext Context Disclosure

Info

Disclosure

Nov 17, 2008

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Attack Type: Cryptographic, Information Disclosure
Impact: Loss of Confidentiality
Solution: Patch / RCS, Upgrade
Disclosure: Vendor Verified

Solution

Products

Unknown or Incomplete

References

Security Tracker: 1021235 1021236
CVE ID: 2008-5161 (see also: NVD)
Bugtraq ID: 32319
Secunia Advisory ID: 32740 32760 33121 33308 34857 35670 36308 36558 38851 40234
ISS X-Force ID: 46620
Related OSVDB ID: 50035
CERT VU: 958563
Keyword: c01820968,HPSBMA02447,SSRT090062
Vendor Specific Advisory URL: http://aix.software.ibm.com/aix/efixes/security/openssh_advisory.asc
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-005.txt.asc
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0011
http://www.openssh.com/txt/cbc.adv
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html
https://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01820968
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-08/0111.html
Other Advisory URL: http://isc.sans.org/diary.html?storyid=5366
http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1
http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
Vendor Specific News/Changelog Entry: http://www.ssh.com/company/news/article/953/
News Article: http://www.theregister.co.uk/2009/05/19/open_ssh_hack/
RedHat RHSA: https://rhn.redhat.com/errata/RHSA-2009-1287.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/50036