SSH "AllowedAuthentications" could allow an attacker to bypass the specified authentication mechanism
| ssh-allowedauthentications-bypass-auth (9163) |  Medium Risk |
Description:
SSH (Secure Shell) could allow a remote attacker to bypass the specified authentication mechanism and gain unauthorized access to the server. If the "AllowedAuthentications" configuration option does not contain "Password" as an authentication option, a remote attacker could bypass the specified authentication mechanism and authenticate to the server using a weaker authentication mechanism.
Consequences:
Bypass Security
Remedy:
Upgrade to the latest version of SSH (3.1.2 or later), available from the SSH Communications Web site. See References.
As a workaround, use "RequiredAuthentications" instead of "AllowedAuthentications".
References:
- BugTraq Mailing List, Thu May 23 2002 - 12:22:29 CDT: [Fwd: Updated version of SSH Secure Shell available].
- CIAC Information Bulletin M-081: SSHD "AllowedAuthentications" Vulnerability.
- SSH Communications Security Web site: SSH - Products - SSH Secure Shell - Download.
- SSH Communications Security Web site: Security Advisory Regarding Vulnerability in SSH Secure Shell for Servers, SSH Secure Shell for Workstations (running in server mode) and SSH Secure Shell for Windows Servers versions 3.0 through 3.1.1.
- BID-4810: SSH Communications Secure Shell Server AllowedAuthentications Configuration Overriding Vulnerability
- CVE-2002-1646: SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
- OSVDB ID: 18238: SSH Secure Shell for Servers AllowedAuthentications Remote Bypass
- US-CERT VU#341187: SSHD allows users to override AllowedAuthentications configuration thereby permitting users to provide any type of authentication
Platforms Affected:
- SSH Secure Shell For Servers 3.0
- SSH Secure Shell For Servers 3.0.1
- SSH Secure Shell For Servers 3.1
- SSH Secure Shell For Servers 3.1.1
Reported:
May 23, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this