CVE-2008-5161

Published: Nov 19, 2008Modified: May 28, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.

Affected (167)

Products: Openbsd: Openssh · Ssh: Tectia Client, Tectia Connector, Tectia Connectsecure, Tectia Server

1 product

4 products

Configuration A

167 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Version 4.7p1
Ssh Tectia Client	Version 4.0.1
Ssh Tectia Client	Version 4.0.3
Ssh Tectia Client	Version 4.0.4
Ssh Tectia Client	Version 4.0.5
Ssh Tectia Client	Version 4.0
Ssh Tectia Client	Version 4.2.1
Ssh Tectia Client	Version 4.2
Ssh Tectia Client	Version 4.3.1
Ssh Tectia Client	Version 4.3.1j
Ssh Tectia Client	Version 4.3.2
Ssh Tectia Client	Version 4.3.2j
Ssh Tectia Client	Version 4.3.3
Ssh Tectia Client	Version 4.3.4
Ssh Tectia Client	Version 4.3.5
Ssh Tectia Client	Version 4.3.6
Ssh Tectia Client	Version 4.3.7
Ssh Tectia Client	Version 4.3.8k
Ssh Tectia Client	Version 4.3.9k
Ssh Tectia Client	Version 4.3
Ssh Tectia Client	Version 4.4.10
Ssh Tectia Client	Version 4.4.11
Ssh Tectia Client	Version 4.4.1
Ssh Tectia Client	Version 4.4.2
Ssh Tectia Client	Version 4.4.3
Ssh Tectia Client	Version 4.4.4
Ssh Tectia Client	Version 4.4.6
Ssh Tectia Client	Version 4.4.7
Ssh Tectia Client	Version 4.4.8
Ssh Tectia Client	Version 4.4.9
Ssh Tectia Client	Version 4.4
Ssh Tectia Client	Version 5.0.0
Ssh Tectia Client	Version 5.0.0f
Ssh Tectia Client	Version 5.0.1
Ssh Tectia Client	Version 5.0.1f
Ssh Tectia Client	Version 5.0.2
Ssh Tectia Client	Version 5.0.2f
Ssh Tectia Client	Version 5.0.3
Ssh Tectia Client	Version 5.0.3f
Ssh Tectia Client	Version 5.1.0
Ssh Tectia Client	Version 5.1.1
Ssh Tectia Client	Version 5.1.2
Ssh Tectia Client	Version 5.1.3
Ssh Tectia Client	Version 5.2.0
Ssh Tectia Client	Version 5.2.1
Ssh Tectia Client	Version 5.2.2
Ssh Tectia Client	Version 5.2.3
Ssh Tectia Client	Version 5.2.4
Ssh Tectia Client	Version 5.3.0
Ssh Tectia Client	Version 5.3.1
Ssh Tectia Client	Version 5.3.2
Ssh Tectia Client	Version 5.3.3
Ssh Tectia Client	Version 5.3.5
Ssh Tectia Client	Version 5.3.6
Ssh Tectia Client	Version 5.3.7
Ssh Tectia Client	Version 5.3.8
Ssh Tectia Client	Version 6.0.0
Ssh Tectia Client	Version 6.0.1
Ssh Tectia Client	Version 6.0.2
Ssh Tectia Client	Version 6.0.3
Ssh Tectia Client	Version 6.0.4
Ssh Tectia Connector	Version 4.0.7
Ssh Tectia Connector	Version 4.1.2
Ssh Tectia Connector	Version 4.1.3
Ssh Tectia Connector	Version 4.1.5
Ssh Tectia Connector	Version 4.2.0
Ssh Tectia Connector	Version 4.3.0
Ssh Tectia Connector	Version 4.3.4
Ssh Tectia Connector	Version 4.3.5
Ssh Tectia Connector	Version 4.4.0
Ssh Tectia Connector	Version 4.4.10
Ssh Tectia Connector	Version 4.4.2
Ssh Tectia Connector	Version 4.4.4
Ssh Tectia Connector	Version 4.4.6
Ssh Tectia Connector	Version 4.4.7
Ssh Tectia Connector	Version 4.4.9
Ssh Tectia Connector	Version 5.0.0
Ssh Tectia Connector	Version 5.0.1
Ssh Tectia Connector	Version 5.0.2
Ssh Tectia Connector	Version 5.0.3
Ssh Tectia Connector	Version 5.1.0
Ssh Tectia Connector	Version 5.1.1
Ssh Tectia Connector	Version 5.1.2
Ssh Tectia Connector	Version 5.1.3
Ssh Tectia Connector	Version 5.2.2
Ssh Tectia Connector	Version 5.3.0
Ssh Tectia Connector	Version 5.3.1
Ssh Tectia Connector	Version 5.3.2
Ssh Tectia Connector	Version 5.3.3
Ssh Tectia Connector	Version 5.3.7
Ssh Tectia Connector	Version 5.3.8
Ssh Tectia Connectsecure	Version 6.0.0
Ssh Tectia Connectsecure	Version 6.0.1
Ssh Tectia Connectsecure	Version 6.0.2
Ssh Tectia Connectsecure	Version 6.0.3
Ssh Tectia Connectsecure	Version 6.0.4
Ssh Tectia Server	Version 4.0.3
Ssh Tectia Server	Version 4.0.4
Ssh Tectia Server	Version 4.0.5
Ssh Tectia Server	Version 4.0.7
Ssh Tectia Server	Version 4.0
Ssh Tectia Server	Version 4.1.2
Ssh Tectia Server	Version 4.1.3
Ssh Tectia Server	Version 4.1.5
Ssh Tectia Server	Version 4.2.0
Ssh Tectia Server	Version 4.2.1
Ssh Tectia Server	Version 4.2.2
Ssh Tectia Server	Version 4.3.0
Ssh Tectia Server	Version 4.3.1
Ssh Tectia Server	Version 4.3.2
Ssh Tectia Server	Version 4.3.3
Ssh Tectia Server	Version 4.3.4
Ssh Tectia Server	Version 4.3.5
Ssh Tectia Server	Version 4.3.6
Ssh Tectia Server	Version 4.3.7
Ssh Tectia Server	Version 4.3
Ssh Tectia Server	Version 4.4.0
Ssh Tectia Server	Version 4.4.10
Ssh Tectia Server	Version 4.4.11
Ssh Tectia Server	Version 4.4.1
Ssh Tectia Server	Version 4.4.2
Ssh Tectia Server	Version 4.4.4
Ssh Tectia Server	Version 4.4.5
Ssh Tectia Server	Version 4.4.6
Ssh Tectia Server	Version 4.4.7
Ssh Tectia Server	Version 4.4.8
Ssh Tectia Server	Version 4.4.9
Ssh Tectia Server	Version 4.4
Ssh Tectia Server	Version 5.0.0
Ssh Tectia Server	Version 5.0.1
Ssh Tectia Server	Version 5.0.2
Ssh Tectia Server	Version 5.0.3
Ssh Tectia Server	Version 5.1.0
Ssh Tectia Server	Version 5.1.1
Ssh Tectia Server	Version 5.1.1
Ssh Tectia Server	Version 5.1.2
Ssh Tectia Server	Version 5.1.3
Ssh Tectia Server	Version 5.2.0
Ssh Tectia Server	Version 5.2.0
Ssh Tectia Server	Version 5.2.1
Ssh Tectia Server	Version 5.2.2
Ssh Tectia Server	Version 5.2.2
Ssh Tectia Server	Version 5.2.3
Ssh Tectia Server	Version 5.2.4
Ssh Tectia Server	Version 5.3.0
Ssh Tectia Server	Version 5.3.0
Ssh Tectia Server	Version 5.3.1
Ssh Tectia Server	Version 5.3.2
Ssh Tectia Server	Version 5.3.3
Ssh Tectia Server	Version 5.3.4
Ssh Tectia Server	Version 5.3.5
Ssh Tectia Server	Version 5.3.6
Ssh Tectia Server	Version 5.3.7
Ssh Tectia Server	Version 5.3.8
Ssh Tectia Server	Version 5.4.0
Ssh Tectia Server	Version 5.4.1
Ssh Tectia Server	Version 5.4.2
Ssh Tectia Server	Version 5.5.0
Ssh Tectia Server	Version 5.5.1
Ssh Tectia Server	Version 6.0.0
Ssh Tectia Server	Version 6.0.0
Ssh Tectia Server	Version 6.0.1
Ssh Tectia Server	Version 6.0.1
Ssh Tectia Server	Version 6.0.2
Ssh Tectia Server	Version 6.0.3
Ssh Tectia Server	Version 6.0.4
Ssh Tectia Server	Version 6.0.4

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-329

Generation of Predictable IV with CBC Mode

The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

References (80)

http://isc.sans.org/diary.html?storyid=5366

Source: cve@mitre.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=125017764422557&w=2

Source: cve@mitre.org

http://openssh.org/txt/cbc.adv

Source: cve@mitre.org

http://osvdb.org/49872

Source: cve@mitre.org

http://osvdb.org/50035

Source: cve@mitre.org

http://osvdb.org/50036

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2009-1287.html

Source: cve@mitre.org

http://secunia.com/advisories/32740

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/32760

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/32833

Source: cve@mitre.org

http://secunia.com/advisories/33121

Source: cve@mitre.org

http://secunia.com/advisories/33308

Source: cve@mitre.org

http://secunia.com/advisories/34857

Source: cve@mitre.org

http://secunia.com/advisories/36558

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1

Source: cve@mitre.org

http://support.apple.com/kb/HT3937

Source: cve@mitre.org

http://support.attachmate.com/techdocs/2398.html

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm

Source: cve@mitre.org

http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/958563

Source: cve@mitre.org

US Government Resource

http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/498558/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/498579/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/32319

Source: cve@mitre.org

http://www.securitytracker.com/id?1021235

Source: cve@mitre.org

http://www.securitytracker.com/id?1021236

Source: cve@mitre.org

http://www.securitytracker.com/id?1021382

Source: cve@mitre.org

http://www.ssh.com/company/news/article/953/

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2008/3172

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/3173

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/3409

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1135

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/3184

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/46620

Source: cve@mitre.org

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667

Source: cve@mitre.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10106

Source: cve@mitre.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10163

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279

Source: cve@mitre.org

http://isc.sans.org/diary.html?storyid=5366