Choose any security protocol that has had vulnerability in the past year, and wr
ID: 3852076 • Letter: C
Question
Choose any security protocol that has had vulnerability in the past year, and write a 2 paragraph post about it. You may choose any protocol, but it MUST be a protocol, or software that implements that protocol, such as OpenSSH or OpenSSL. You MUST include a CVE number for the vulnerability. Specifically, discuss:
What version(s) are affected.
The CVE number associated with the vulnerability.
The date the vulnerability was disclosed (or the CVE date if the disclosure date is unavailable).
The impact of this vulnerability.
Any mitigation steps to avoid or fix the vulnerability.
Include links to at least one other source of information about the vulnerabiilty, besides the CVE link.
Explanation / Answer
Here I choose "session key recovery vulnerability in SSH protocol 1.5"
It was published on 2001-02-07.
CVE Number is CVE-2001-0361
Vulnerability issue is Cryptographic Issues
The date the vulnerability was disclosed is 2001-09-18
Vulnerabilty Description:
The implementations of the SSH version 1.5, including
1. OpenSSH up to the version 2.3.0,
2. AppGate, and (
3. ssh-1 up to the version 1.2.31, in certain configurations, allows remote hackers to decrypt or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5.
Solution:
OpenSSH
OpenSSH up to version 2.3.0 is vulnerable, but does impossible to exploit it because of limits of the number of simultaneous connections, the server is allowed to handle,This effectively solves the problem by closing oracle which leaks the information.
OpenSSH as much as version 2.3.0 is vulnerable, but it is impossible to make it because of limits of the quantity of connections simultaneously, the server is allowed to address,This successfully solves the trouble with the aid of final oracle which leaks the information.
These patch was integrated to the OpenSSH source tree on Jan 29, 2001
AppGate
The AppGate server default configuration of is not vulnerable since it has SSH-1 support disabled. However it is possible for administrators to enable SSH-1 backwards compatibility to use legacy clients. These customers should apply the patches what have prepared. Patches can be downloaded from the AppGate support website.