Project

General

Profile

Bug #1278

ssh banner parsing issue

Added by Victor Julien about 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Reported privately.

History

#1

Updated by Victor Julien almost 5 years ago

  • Subject changed from ssh issue to ssh banner parsing issue
  • Priority changed from Normal to High
    app-layer-ssh: fix banner parser

    Carefully crafted SSH banner could result in parser error.

    CVE 2014-6603

    Signed-off-by: Eric Leblond <eric@regit.org>

Reported by Steffen Bauch

#2

Updated by Victor Julien almost 5 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100
#3

Updated by Victor Julien almost 5 years ago

A work around is to simply disable the ssh app layer module:

app-layer:
  protocols:
    tls:
      enabled: yes
      detection-ports:
        dp: 443

      #no-reassemble: yes
    dcerpc:
      enabled: yes
    ftp:
      enabled: yes
    ssh:
      enabled: no

Alternatively, it can be set to 'detection-only'.

Also available in: Atom PDF