Bug 558 - OpenSSH Vulnerability

Review Request #460 — Created Sept. 18, 2024 and updated — Latest diff uploaded

kevin.poh
APV10
rel_apv_10_7
558
timlai, weikai

Problem:
No error message is displayed when setting an unsupported cipher string.

Solution:
The variable MAX_SSH_CIPHER_TYPE needs to be updated to match the total number of ciphers listed in ssh_ciphers.
The logic in the "check_ssh_ciphers_legal" function is already correct, but the incorrect initial value of this variable is causing the function to behave unexpectedly.

Normal Behaviour is :

AN(config)#show runn ssh

ssh configuration

ssh on
ssh auth passwd on "array"
ssh auth key off "array"
ssh kex "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521"
ssh cipher "aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com"
ssh port 22
ssh idletimeout 30

AN(config)#ssh cipher "aes128-ctr"

===============================================================
Before fix :

AN(config)#ssh cipher "123123"

If an incorrect cipher is entered, the system may hang for some time, and no error message is displayed.

===============================================================
After fix :

AN(config)#ssh cipher "111"
Cipher 111 isn't supported. Supported ciphers are: aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com. Please input again.
Failed to execute "ssh cipher "111""

After the fix, if an incorrect cipher is entered, an error warning will be displayed, and the system will no longer hang.

    Loading...