Welcome to the VanDyke Software Forums

Join the discussion today!


Go Back   VanDyke Software Forums > General

Reply
 
Thread Tools Display Modes
  #1  
Old 07-05-2020, 04:30 AM
tobie.keno tobie.keno is offline
Registered User
 
Join Date: Jul 2020
Posts: 1
Exclamation Targeted MiTM attacks: OpenSSH 5.7-8.3

FZI have published research demonstrating a proof of concept for targeted MiTM attacks using information leakage in SSH clients.

The website contains a top-level overview of the vulnerability:

https://www.fzi.de/en/news/news/deta...f-ssh-clients/

OpenSSH refuse to fix it because it may break backwards compatibility. PuTTY have however pushed out an emergency patch to fix it in their software.

CVE-2020-14002 and CVE-2020-14145 contain the details:

https://nvd.nist.gov/vuln/detail/CVE-2020-14002
https://nvd.nist.gov/vuln/detail/CVE-2020-14145

Are Van Dyke going to implement a mitigation or does SecureCRT already protect against this?

If not, maybe place a warning advising users,

Quote:
"Otherwise, by setting the option HostKeyAlgorithms explicitly (without '+', '-' or '^') the adaptive order of the host key algorithms can be disabled including the aforementioned drawback."
Reply With Quote
  #2  
Old 07-08-2020, 01:31 PM
Maureen's Avatar
Maureen Maureen is offline
VanDyke Product Director
 
Join Date: Feb 2004
Location: Albuquerque, NM
Posts: 1,586
Like OpenSSH, SecureCRT and SecureFX have leaks related to SSH2 algorithm negotiation. The first time a connection to an SSH2 device is made, the list of supported host key algorithms is sent in plain text. On subsequent connections, an attacker might be able to use that information to deduce that the client has previously connected to the server.

For the SSH2 protocol, manually verifying that the host key is correct is the only way to mitigate a man-in-the-middle attack.

We are assessing CVE-2020-14002 and CVE-2020-14145 in order to determine if a patch is warranted.

We will post any updates here. If you would like to be notified directly, please send an email to Maureen.Jett@vandyke.com.

Maureen
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -6. The time now is 01:29 PM.