CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.

We have received reports that the 'SSH CRC-32 compensation attack detector vulnerability' is being actively exploited. This is the same integer type error previously corrected for OpenSSH in DSA-027-1.
OpenSSH (the Debian ssh package) was fixed at that time, but ssh-nonfree and ssh-socks were not.

Though packages in the non-free section of the archive are not officially supported by the Debian project, we are taking the unusual step of releasing updated ssh-nonfree/ssh-socks packages for those users who have not yet migrated to OpenSSH. However, we do recommend that our users migrate to the regularly supported, DFSG-free 'ssh' package as soon as possible. ssh 1.2.3-9.3 is the OpenSSH package available in Debian 2.2r4.

The fixed ssh-nonfree/ssh-socks packages are available in version 1.2.27-6.2 for use with Debian 2.2 (potato) and version 1.2.27-8 for use with the Debian unstable/testing distribution. Note that the new ssh-nonfree/ssh-socks packages remove the setuid bit from the ssh binary, disabling rhosts-rsa authentication. If you need this functionality, run

chmod u+s /usr/bin/ssh1

after installing the new package.

- Versions of OpenSSH prior to 2.3.0 are vulnerable to a     remote arbitrary memory overwrite attack which may lead     to a root exploit.
  - CORE-SDI has described a problem with regards to RSA key     exchange and a Bleichenbacher attack to gather the     session key from an ssh session.

Both of these issues have been corrected in our ssh package 1.2.3-9.2.
We recommend you upgrade your openssh package immediately.

The remote host is using a version of SSH.com's SSH older than version 1.2.32 or a version of OpenSSH older than 2.3.0. These versions are vulnerable to a buffer overflow that may allow an attacker to obtain a root shell on this host.

The remote host is running a version of SSH that is older than version 1.2.32, or a version of OpenSSH that is older than 2.3.0.

The remote version of this software is vulnerable to a flaw known as a 'CRC-32 compensation attack' that could allow an attacker to gain a root shell on this host.

ID	Name	Product	Family	Severity
14923	Debian DSA-086-1 : ssh-nonfree - remote root exploit	Nessus	Debian Local Security Checks	critical
14864	Debian DSA-027-1 : OpenSSH - remote exploit	Nessus	Debian Local Security Checks	critical
1980	SSH1 CRC-32 detect_attack Function Overflow	Nessus Network Monitor	SSH	critical
10607	SSH CRC-32 Compensation Attack Remote Overflow	Nessus	Misc.	critical

Detections

Analytics

CVE-2001-0144

critical

Tenable Plugins

critical

critical

critical

critical