Certain Cisco products containing support for the Secure Shell (SSH) server are vulnerable to a Denial of Service (DoS) if the SSH server is enabled on the device. A malformed SSH packet directed at the affected device can cause a reload of the device. No authentication is necessary for the packet to be received by the affected device. The SSH server in Cisco IOS is disabled by default.

Cisco will be making free software available to correct the problem as soon as possible.

The malformed packets can be generated using the SSHredder test suite from Rapid7, Inc. Workarounds are available. The Cisco PSIRT is not aware of any malicious exploitation of this vulnerability.

According to its banner, the remote SSH server is affected by one or more of the following vulnerabilities :

  - CVE-2002-1357 (incorrect length)

  - CVE-2002-1358 (lists with empty elements/empty strings)

  - CVE-2002-1359 (large packets and large fields)

  - CVE-2002-1360 (string fields with zeros)

The impact of successful exploitation of these vulnerabilities varies across products.  In some cases, remote attackers will be able to execute arbitrary code with the privileges of the SSH process (usually root), although for the products currently tested, the maximum impact is believed to be just a denial of service.

It is possible to make the remote IOS crash when sending it malformed SSH packets during the key exchange.

These flaws are documented as CISCO bug ID CSCdz60229, CSCdy87221 and CSCdu75477.

Secure Shell（SSH）サーバー向けのサポートがある特定の Cisco 製品は、デバイスで SSH サーバーが有効な場合、サービス拒否（DoS）に脆弱です。影響を受けるデバイスに向けられた無効な形式の SSH パケットにより、デバイスのリロードが引き起こされる可能性があります。影響を受けるデバイスが受信するパケットの場合、認証は不要です。Cisco IOS では、SSH サーバーはデフォルトで無効です。

Cisco では、この問題を修正する無料のソフトウェアをできるだけ早く利用できるように準備しています。

Rapid7, Inc. が提供する SSHredder テストパッケージを使用することで、無効な形式のパケットを生成することができます。回避策が利用可能です。Cisco PSIRT は、この脆弱性の悪用について認識していません。

The remote SSH server (or client) is vulnerable to various vulnerabilities that may allow an attacker to obtain a root shell on this host.

The remote SSH server is vulnerable to various vulnerabilities that may allow an attacker to obtain a root shell on this host.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
48968	SSH Malformed Packet Vulnerabilities - Cisco Systems	Nessus	CISCO	2010/9/1	2018/11/15	critical
11195	SSH Multiple Remote Vulnerabilities	Nessus	Misc.	2002/12/20	2018/11/15	medium
11383	Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477)	Nessus	CISCO	2003/3/14	2018/6/27	critical
48968	SSH の無効な形式のパケットの脆弱性 - Cisco Systems	Nessus	CISCO	2010/9/1	2018/11/15	critical
1974	SSH Multiple Vulnerabilities	Nessus Network Monitor	SSH	2004/8/20	2019/3/6	critical
1973	SSH Multiple Vulnerabilities	Nessus Network Monitor	SSH	2004/8/20	2019/3/6	critical
1975	SSH Multiple Vulnerabilities	Nessus Network Monitor	SSH	2004/8/20	2019/3/6	critical

検出

プラグインの検索

critical

medium

critical

critical

critical

critical

critical