Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.

Certain Cisco products containing support for the Secure Shell (SSH) server are vulnerable to a Denial of Service (DoS) if the SSH server is enabled on the device. A malformed SSH packet directed at the affected device can cause a reload of the device. No authentication is necessary for the packet to be received by the affected device. The SSH server in Cisco IOS is disabled by default.

Cisco will be making free software available to correct the problem as soon as possible.

The malformed packets can be generated using the SSHredder test suite from Rapid7, Inc. Workarounds are available. The Cisco PSIRT is not aware of any malicious exploitation of this vulnerability.

The remote SSH server (or client) is vulnerable to various vulnerabilities that may allow an attacker to obtain a root shell on this host.

The remote SSH server is vulnerable to various vulnerabilities that may allow an attacker to obtain a root shell on this host.

It is possible to make the remote IOS crash when sending it malformed SSH packets during the key exchange.

These flaws are documented as CISCO bug ID CSCdz60229, CSCdy87221 and CSCdu75477.

According to its banner, the remote SSH server is affected by one or more of the following vulnerabilities :

  - CVE-2002-1357 (incorrect length)

  - CVE-2002-1358 (lists with empty elements/empty strings)

  - CVE-2002-1359 (large packets and large fields)

  - CVE-2002-1360 (string fields with zeros)

The impact of successful exploitation of these vulnerabilities varies across products.  In some cases, remote attackers will be able to execute arbitrary code with the privileges of the SSH process (usually root), although for the products currently tested, the maximum impact is believed to be just a denial of service.

ID	Name	Product	Family	Severity
48968	SSH Malformed Packet Vulnerabilities - Cisco Systems	Nessus	CISCO	critical
1975	SSH Multiple Vulnerabilities	Nessus Network Monitor	SSH	critical
1974	SSH Multiple Vulnerabilities	Nessus Network Monitor	SSH	critical
1973	SSH Multiple Vulnerabilities	Nessus Network Monitor	SSH	critical
11383	Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477)	Nessus	CISCO	critical
11195	SSH Multiple Remote Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2002-1360

critical

Tenable Plugins

critical

critical

critical

critical

critical

medium