Advisory ID: cisco-sa-20030917-openssh
For Public Release 2003 September 17 07:00 UTC (GMT)
New vulnerabilities in the OpenSSH implementation for SSH servers have been announced.
An affected network device, running an SSH server based on the OpenSSH implementation, may be vulnerable to a Denial of Service (DoS) attack when an exploit script is repeatedly executed against the same device. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory will be posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh.
This section provides details on affected products.
The following products, have their SSH server implementation based on the OpenSSH code, and are affected by the OpenSSH vulnerabilities.
- Cisco Catalyst Switching Software (CatOS)
Cisco's various Catalyst family of switches run CatOS-based releases or IOS-based releases.
IOS-based releases are not vulnerable.
All K9 (crypto) images in 6.x, 7.x, and 8.x release trains are affected by these vulnerabilities. CatOS releases 2.x, 3.x, 4.x and 5.x are not vulnerable as they do not have SSH support.
The following Cisco Catalyst Switches are vulnerable:
- Catalyst 6000 series
- Catalyst 5000 series
- Catalyst 4000 series
- Catalyst 2948G, 2980G, 2980G-A, 4912G - use Catalyst 4000 series code base
To determine your software revision, type show version command at the command line prompt.
- Cisco Secure Intrusion Detection System (NetRanger) appliance
The following devices (running software version 3.0(1) through 4.1(1)) are vulnerable:
- IDS-42xx appliances
- Cisco Network Analysis Modules (NAM) for the Cisco Catalyst 6000 and 6500 Series switches and Cisco 7600 Series routers
The following devices that have applied the K9 crypto patch and have SSH enabled are vulnerable:
- WS-X6380-NAM, running software version 2.1(2) or 3.1(1a)
- WS-SVC-NAM-1, running software version 2.2(1a) or 3.1(1a)
- WS-SVC-NAM-2, running software version 2.2(1a) or 3.1(1a)
- CiscoWorks 1105 Hosting Solution Engine (HSE)
- CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)
- Cisco Content Service CSS 11000 Switch series
- Cisco Application & Content Networking Software (ACNS)
- BTS 10200 Softswitch
- Cisco GSS 4480 Global Site Selector
- Cisco SN 5428 Storage Router
- Cisco PGW 2200 Softswitch (formerly known as Cisco VSC 3000 and as Cisco SC 2200)
Cisco has not released code with SSH for the SN5420 storage router.
The following products, which incorporate a SSH server, have been confirmed to be not vulnerable to the OpenSSH vulnerabilities.
- Cisco IOS, both SSH version 1.5 and SSH version 2.0
- Cisco Secure Intrusion Detection System Catalyst Module (IDSM)—model number WS-X6381-IDS
- Cisco PIX Firewall
- Cisco Catalyst 6000 FireWall Service Module (FWSM)
- Cisco VPN 3000 Concentrators and Cisco VPN 5000 Concentrators
- Cisco MDS 9000 Series Multilayer Switches
No other Cisco products are currently known to be affected by these vulnerabilities.
The buffer size or the number of channels in the fixed code is now correctly incremented only after a successful allocation where as initially they were being set before an allocation. Upon an allocation failure, which could be externally triggered, memory contents would be incorrectly erased by the cleanup process. This would result in a corruption of the memory which would eventually lead to a crash for the process using that memory.
Portable OpenSSH version (not OpenBSD version) 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM authentication code. These vulnerabilities are not known to affect any Cisco products.
Please note, the SSH server code under Cisco IOS has other vulnerabilities as documented by http://www.cisco.com/warp/public/707/ssh-packet-suite-vuln.shtml which may be triggered by the code written to exploit the OpenSHH vulnerabilities.
- Cisco Catalyst Switching Software (CatOS)—This vulnerability is documented as Bug ID CSCec33092 ( registered customers only) .
If SSH is disabled the Catalyst switch will not be vulnerable to these vulnerabilities. CatOS K9 (crypto) release 6.1 was the first CatOS release which incorporated the SSH feature.
To verify if SSH has been configured on the switch type show crypto key. If this shows you the RSA key then SSH has been configured and enabled on the switch. To remove the crypto key type clear crypto key RSA and this will disable the SSH server on the switch.
- Cisco Secure Intrusion Detection System (NetRanger) appliance—This vulnerability is documented as Bug IDs CSCec32508 ( registered customers only) and CSCec37419 ( registered customers only)
- Cisco Network Analysis Modules (NAM)—This vulnerability is documented as Bug ID CSCec35975 ( registered customers only) .
To verify if the K9 crypto patch is installed, type the show patch command. To verify if SSH access has been enabled using the exsession on ssh command, type the show ip command, and if the line starting with "SSH:" shows "Enabled" you are vulnerable.
- CiscoWorks 1105 Hosting Solution Engine (HSE)—This vulnerability is documented as Bug IDs CSCec34502 ( registered customers only) and CSCec34522 ( registered customers only) .
- CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)—This vulnerability is documented as Bug IDs CSCec33254 ( registered customers only) and CSCec34521 ( registered customers only) .
- Cisco Content Service CSS11000 Switch series—Cisco WebNS 5.x, 6.x and 7.x are affected. This vulnerability is documented as Bug ID CSCec35690 ( registered customers only) .
- Cisco Application & Content Networking Software (ACNS)—All versions affected. This vulnerability is documented as Bug ID CSCec32387 ( registered customers only) .
- BTS 10200 Softswitch—All releases prior to RLS 3.5.3 are affected. A new openssh package has been made available.
- Cisco GSS 4480 Global Site Selector—All versions affected. This vulnerability is documented as Bug ID CSCec32245 ( registered customers only) .
- Cisco SN 5428 Storage Router—
Vulnerable versions are:
This vulnerability is documented as Bug ID CSCec32301 ( registered customers only) . For more information on the SN 5428 please refer to http://www.cisco.com/en/US/products/hw/ps4159/ps2160/index.html.
- Cisco PGW 2200 Softswitch—The following PGW 2200 components that have applied the CSCOk9000 crypto package found in PGW Restricted Software 1.0(1) are vulnerable:
- PGW Host platform running MGC application software, and optionally MNM-PT application software
- HSI host platform running HSI application software
- BAMS platform running BAMS application software
- A separate node management platform running the MNM-PT application software
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding CVSS at
Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
An affected device, running an SSH server based on the OpenSSH implementation, may be vulnerable to a DoS attack when an exploit script is repeatedly executed against the same device.
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.
- Cisco Catalyst Switching Software (CatOS)—CatOS release schedule:
- 6.4(7) for Catalyst 4000/5000/6000 series switches due out on November 12, 2003
- 7.6(3a) for Catalyst 4000 series switches due out on September 30, 2003
- 7.6(3a) for Catalyst 6000 series switches due out on September 26, 2003
- 8.1(3) for Catalyst 6000 series switches due out on October 13, 2003
- 8.2(1)GLX for Catalyst 4000 series switches due out on September 25, 2003
- 8.2(1) for Catalyst 6000 series switches due out in 4th Quarter 2003
Software upgrades can be performed via the console interface. Please refer to software release notes for instructions.
- Cisco Secure Intrusion Detection System (NetRanger) appliance—Software version 4.1(2), due out end of October, will have the fix. Software version 3.1(5) will have the fix for software version 3.1; release date to be determined.
- Cisco Network Analysis Modules (NAM)—An updated k9 crypto patch for the 3.1 images, due out middle of October, will have the fix.
- CiscoWorks 1105 Hosting Solution Engine (HSE)—Software version 1.7.2, due out October 10, will have the fix.
- CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)—Release date to be determined.
- Cisco Content Service CSS11000 Switch series—Software versions 22.214.171.124s, 126.96.36.199s, 188.8.131.52s and 184.108.40.206s, due out October 3, will have the fix.
- Cisco Application & Content Networking Software (ACNS)-Software versions 5.1 and 5.0.7 will have the fix. Software version 5.0.7 is due out September 30.
- BTS 10200 Softswitch-A new openssh package has been made available. Please contact your Cisco SE for more information.
- Cisco GSS 4480 Global Site Selector—Software version 1.1(0) code, due out on October 10, will have the fix.
- Cisco SN 5428 Storage Router—Software version 3.4.1, due out end of September, will have the fix for the SN 5428 and SN 5428-2.
- Cisco PGW 2200 Softswitch—Software version 1.0(2), due out end of November, will have the fix.
The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code as soon as it is available.
- The following workarounds can be implemented for CatOS based switches.
- Apply IP Permit List for SSH to enable access to the switch's management interface only from the network management workstations.
For instructions on how to do this, please refer to http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_6_1/config/ip_perm.htm.
- On the Catalyst 6000 series switches, if the VLAN Access Control List (ACL) (VACL) feature is available in the code base, you can use VACLs instead of the IP Permit List workaround above.
For instructions on how to do this, please refer to http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/6.x/configuration/guide/acc_list.html.
- mplement the best practice to assign all of the management interfaces of all the switches in the network to a different VLAN, and apply appropriate ACLs on the router switching between the VLANs.
For an example, see http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/6.x/configuration/guide/acc_list.html
- Apply ACLs on routers / switches / firewalls in front of the vulnerable switches such that traffic destined for the SSH TCP port 22 on the vulnerable switches is only allowed from the network management workstations.
For an example, see http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/6.x/configuration/guide/acc_list.html.
- To turn off SSH access on the Cisco Network Analysis Modules (NAM), type the exsession off ssh command.
- Wherever possible, restrict access to the SSH server on the network device. Allow access to the network device only from trusted workstations by using ACLs / MAC filters that are available on the affected platforms.
Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact either "email@example.com" or "firstname.lastname@example.org" for software upgrades.
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.
Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.
- +1 800 553 2447 (toll free from within North America)
- +1 408 526 7209 (toll call from anywhere in the world)
- e-mail: email@example.com
Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.
Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
This advisory will be posted on Cisco's worldwide website at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20030917-openssh.
In addition to worldwide website posting, a text version of this advisory is clear-signed with the Cisco PSIRT PGP key having the fingerprint 8C82 5207 0CA9 ED40 1DD2 EE2A 7B31 A8CF 32B6 B590 and is posted to the following e-mail and Usenet news recipients:
- firstname.lastname@example.org (includes CERT/CC)
- Various internal Cisco mailing lists
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Added Cisco PGW 2200 Softswitch as a vulnerable product. Added 8.1(3) as a fixed release for CatOS.
Added not vulnerable to Portable OpenSSH version in the details section. Added ACNS and BTS10200 as vulnerable. Added 5.x as affected release for CSS11000. Updated fix information for NAM.
Added CatOS release schedule in Software Versions and Fixes.
Added Cisco Content Service CSS11000 Switch series and Cisco Network Analysis Modules (NAM) as being affected.
Added an additional workaround for the CatOS in the Workaround section.
Added CatOS versions, Cisco Secure Intrusion Detection System (NetRanger) appliance, and Cisco GSS 4480 Global Site Selector to the Affected Products section; and Cisco Secure Intrusion Detection System Catalyst Module (IDSM) to the not vulnerable list. Added Cisco Secure Intrusion Detection System (NetRanger) appliance, and Cisco GSS 4480 Global Site Selector to the Details section, and added Bug IDs for the products. Added Cisco Secure Intrusion Detection System (NetRanger) appliance to the Software Versions and Fixes section, and added upcoming fixes for the products.
Initial public release.