Sign-up

ID

VAR-200505-0778


CVE

CVE-2005-1609


TITLE

Multiple Cisco products consume excessive CPU resources in response to large SSH packets

Trust: 0.8

sources: CERT/CC: VU#290140

DESCRIPTION

Unknown vulnerability in Sun StorEdge 6130 Arrays (SE6130) with serial numbers between 0451AWF00G and 0513AWF00J allows local users and remote attackers to delete data. Multiple Cisco networking products contain a denial-of-service vulnerability. There is an information integrity vulnerability in the SSH1 protocol that allows packets encrypted with a block cipher to be modified without notice. There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root. The program pgp4pine version 1.75.6 fails to properly identify expired keys when working with the Gnu Privacy Guard program (GnuPG). This failure may result in the clear-text transmission of senstive information when used with the PINE mail reading package. The SEDUM web server permits intruders to access files outside the web root. While addressing vulnerabilities described in http://www.cisco.com/warp/public/707/SSH-multiple-pub.html, a denial of service condition has been inadvertently introduced into firmware upgrades. Firmware for routers and switches (IOS), Catalyst 6000 switches running CatOS, Cisco PIX Firewall and Cisco 11000 Content Service Switch devices may be vulnerable. Cisco has reported that scanning for SSH vulnerabilities on affected devices will cause excessive CPU consumption. The condition is due to a failure of the Cisco SSH implementation to properly process large SSH packets. Repeated and concurrent attacks may result in a denial of device service. As many of these devices are critical infrastructure components, more serious network outages may occur. Cisco has released upgrades that will eliminate this vulnerability

Trust: 6.93

sources: NVD: CVE-2005-1609 // CERT/CC: VU#290140 // CERT/CC: VU#13877 // CERT/CC: VU#812438 // CERT/CC: VU#25309 // CERT/CC: VU#945216 // CERT/CC: VU#566640 // CERT/CC: VU#651994 // CERT/CC: VU#315308 // BID: 5114

AFFECTED PRODUCTS

vendor:ssh securitymodel: - scope: - version: -

Trust: 3.2

vendor:ciscomodel:catalyst csxscope:eqversion:60005.3

Trust: 2.4

vendor:ciscomodel: - scope: - version: -

Trust: 1.6

vendor:opensshmodel: - scope: - version: -

Trust: 1.6

vendor:ciscomodel:ios 12.1 exscope: - version: -

Trust: 1.2

vendor:sunmodel:storedge 6130 arraysscope:eqversion:*

Trust: 1.0

vendor:ciscomodel:catalystscope:eqversion:60006.1

Trust: 0.9

vendor:ciscomodel:catalystscope:eqversion:60005.5

Trust: 0.9

vendor:sun microsystemsmodel: - scope: - version: -

Trust: 0.8

vendor:core sdimodel: - scope: - version: -

Trust: 0.8

vendor:debianmodel: - scope: - version: -

Trust: 0.8

vendor:freebsdmodel: - scope: - version: -

Trust: 0.8

vendor:smoothwallmodel: - scope: - version: -

Trust: 0.8

vendor:susemodel: - scope: - version: -

Trust: 0.8

vendor:holger lammmodel: - scope: - version: -

Trust: 0.8

vendor:sunmodel:storedge 6130 arraysscope: - version: -

Trust: 0.6

vendor:ciscomodel:pix firewallscope:eqversion:6.2

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.1

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.0

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:5.3

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:5.2

Trust: 0.3

vendor:ciscomodel:ios 12.2yhscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ygscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2yfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ydscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ycscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ybscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2yascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xwscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xtscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xsscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xrscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xqscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xnscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xmscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xlscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xkscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xjscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xiscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xhscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xgscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xescope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xdscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xbscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2xascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2tscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2sscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2ddscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2dascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2bcscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2bscope: - version: -

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:12.2

Trust: 0.3

vendor:ciscomodel:ios 12.1yiscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1yfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1yescope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ydscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ycscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ybscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xuscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xtscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xqscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xpscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xmscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xlscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xjscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xiscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xhscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xgscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xfscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xcscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1xbscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1tscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1ecscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.1escope: - version: -

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:12.0xv

Trust: 0.3

vendor:ciscomodel:ios 12.0xmscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0xbscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0stscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0spscope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.0sscope: - version: -

Trust: 0.3

vendor:ciscomodel:css11000 content services switchscope: - version: -

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60007.1(2)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60007.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.3(4)

Trust: 0.3

vendor:ciscomodel:catalyst panscope:eqversion:60006.3

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.2(0.111)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.2(0.110)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.1(2.13)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60006.1(1)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(4)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(3)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(2)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(13)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.5(1)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(4)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(3)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(2)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4(1)

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4

Trust: 0.3

sources: CERT/CC: VU#290140 // CERT/CC: VU#13877 // CERT/CC: VU#812438 // CERT/CC: VU#25309 // CERT/CC: VU#945216 // CERT/CC: VU#566640 // CERT/CC: VU#315308 // BID: 5114 // CNNVD: CNNVD-200505-1066 // NVD: CVE-2005-1609

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2005-1609
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#290140
value: 21.09

Trust: 0.8

CARNEGIE MELLON: VU#13877
value: 6.84

Trust: 0.8

CARNEGIE MELLON: VU#812438
value: 5.67

Trust: 0.8

CARNEGIE MELLON: VU#25309
value: 0.39

Trust: 0.8

CARNEGIE MELLON: VU#945216
value: 99.00

Trust: 0.8

CARNEGIE MELLON: VU#566640
value: 0.68

Trust: 0.8

CARNEGIE MELLON: VU#651994
value: 1.50

Trust: 0.8

CARNEGIE MELLON: VU#315308
value: 2.06

Trust: 0.8

CNNVD: CNNVD-200505-1066
value: HIGH

Trust: 0.6

NVD: CVE-2005-1609
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: FALSE
obtainUserPrivilege: TRUE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

sources: CERT/CC: VU#290140 // CERT/CC: VU#13877 // CERT/CC: VU#812438 // CERT/CC: VU#25309 // CERT/CC: VU#945216 // CERT/CC: VU#566640 // CERT/CC: VU#651994 // CERT/CC: VU#315308 // CNNVD: CNNVD-200505-1066 // NVD: CVE-2005-1609

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-1609

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200505-1066

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-200505-1066

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2005-1609

EXTERNAL IDS
db:CERT/CCid:VU#13877
Trust: 3.2
db:CERT/CCid:VU#945216
Trust: 2.4
db:CERT/CCid:VU#25309
Trust: 2.4
db:SECUNIAid:15306
Trust: 2.4
db:CERT/CCid:VU#812438
Trust: 2.4
db:OSVDBid:16325
Trust: 1.6
db:BIDid:13566
Trust: 1.6
db:SECTRACKid:1013921
Trust: 1.6
db:NVDid:CVE-2005-1609
Trust: 1.6
db:VUPENid:ADV-2005-0491
Trust: 1.6
db:BIDid:5114
Trust: 1.1
db:CERT/CCid:VU#290140
Trust: 0.8
db:XFid:6449
Trust: 0.8
db:BIDid:2347
Trust: 0.8
db:XFid:6083
Trust: 0.8
db:XFid:6135
Trust: 0.8
db:BIDid:2405
Trust: 0.8
db:CERT/CCid:VU#566640
Trust: 0.8
db:BIDid:2335
Trust: 0.8
db:XFid:6063
Trust: 0.8
db:CERT/CCid:VU#651994
Trust: 0.8
db:XFid:6472
Trust: 0.8
db:CERT/CCid:VU#315308
Trust: 0.8
db:XFid:20542
Trust: 0.6
db:XFid:6130
Trust: 0.6
db:SUNALERTid:57771
Trust: 0.6
db:CNNVDid:CNNVD-200505-1066
Trust: 0.6
sources:
            
            
            CERT/CC: VU#290140 // 
            
            
            
            CERT/CC: VU#13877 // 
            
            
            
            CERT/CC: VU#812438 // 
            
            
            
            CERT/CC: VU#25309 // 
            
            
            
            CERT/CC: VU#945216 // 
            
            
            
            CERT/CC: VU#566640 // 
            
            
            
            CERT/CC: VU#651994 // 
            
            
            
            CERT/CC: VU#315308 // 
            
            
            
            BID: 5114 // 
            
            
            
            CNNVD: CNNVD-200505-1066 // 
            
            
            
            NVD: CVE-2005-1609

REFERENCES
url:http://www.kb.cert.org/vuls/id/13877
Trust: 2.4
url:http://www.ssh.com/products/ssh/cert/
Trust: 2.4
url:http://www.cert.org/advisories/ca-2001-35.html
Trust: 1.6
url:http://www.kb.cert.org/vuls/id/945216
Trust: 1.6
url:http://www.kb.cert.org/vuls/id/25309
Trust: 1.6
url:http://www.kb.cert.org/vuls/id/812438
Trust: 1.6
url:http://www.securityfocus.com/bid/13566
Trust: 1.6
url:http://www.osvdb.org/16325
Trust: 1.6
url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-57771-1
Trust: 1.6
url:http://securitytracker.com/id?1013921
Trust: 1.6
url:http://secunia.com/advisories/15306
Trust: 1.6
url:http://www.cisco.com/warp/public/707/ssh-scanning.shtml
Trust: 1.1
url:http://www.vupen.com/english/advisories/2005/0491
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/20542
Trust: 1.0
url:http://www.securityfocus.com/bid/5114
Trust: 0.8
url:http://www.cisco.com/warp/public/707/ssh-multiple-pub.html
Trust: 0.8
url:http://www.corest.com/files/files/11/crc32.pdf
Trust: 0.8
url:http://www1.corest.com/common/showdoc.php?idx=131&idxseccion=10
Trust: 0.8
url:http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-57771-1
Trust: 0.8
url:http://secunia.com/advisories/15306/
Trust: 0.8
url:http://xforce.iss.net/static/6449.php
Trust: 0.8
url:http://razor.bindview.com/publish/advisories/adv_ssh1crc.html
Trust: 0.8
url:http://www1.corest.com/common/showdoc.php?idx=81&idxsection=10#
Trust: 0.8
url:http://www.openssh.com/security.html
Trust: 0.8
url:http://www.securityfocus.com/bid/2347
Trust: 0.8
url:http://www.ssh.com/products/ssh/advisories/ssh1_crc-32.cfm
Trust: 0.8
url:http://xforce.iss.net/static/6083.php
Trust: 0.8
url:http://xforce.iss.net/alerts/advise100.php
Trust: 0.8
url:http://www.cryptnet.net/fcp/audit/pgp4pine/01.html
Trust: 0.8
url:http://www.securityfocus.com/bid/2405
Trust: 0.8
url:http://xforce.iss.net/static/6135.php
Trust: 0.8
url:http://devrandom.net/lists/archives/2001/2/bugtraq/0383.html
Trust: 0.8
url:http://security-archive.merton.ox.ac.uk/bugtraq-200102/0389.html
Trust: 0.8
url:http://pgp4pine.flatline.de/
Trust: 0.8
url:http://www.securityfocus.com/bid/2335
Trust: 0.8
url:http://xforce.iss.net/static/6063.php
Trust: 0.8
url:http://www.securityfocus.com/archive/1/160452
Trust: 0.8
url:http://xforce.iss.net/static/6472.php
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/20542
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/0491
Trust: 0.6
sources:
            
            
            CERT/CC: VU#290140 // 
            
            
            
            CERT/CC: VU#13877 // 
            
            
            
            CERT/CC: VU#812438 // 
            
            
            
            CERT/CC: VU#25309 // 
            
            
            
            CERT/CC: VU#945216 // 
            
            
            
            CERT/CC: VU#566640 // 
            
            
            
            CERT/CC: VU#651994 // 
            
            
            
            CERT/CC: VU#315308 // 
            
            
            
            BID: 5114 // 
            
            
            
            CNNVD: CNNVD-200505-1066 // 
            
            
            
            NVD: CVE-2005-1609

CREDITS
This issue was reported by Sun.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200505-1066

SOURCES
db:CERT/CCid:VU#290140
db:CERT/CCid:VU#13877
db:CERT/CCid:VU#812438
db:CERT/CCid:VU#25309
db:CERT/CCid:VU#945216
db:CERT/CCid:VU#566640
db:CERT/CCid:VU#651994
db:CERT/CCid:VU#315308
db:BIDid:5114
db:CNNVDid:CNNVD-200505-1066
db:NVDid:CVE-2005-1609

LAST UPDATE DATE
2022-05-06T22:35:16.451000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#290140date:2002-12-12T00:00:00
db:CERT/CCid:VU#13877date:2003-05-20T00:00:00
db:CERT/CCid:VU#812438date:2005-05-12T00:00:00
db:CERT/CCid:VU#25309date:2002-03-05T00:00:00
db:CERT/CCid:VU#945216date:2003-05-20T00:00:00
db:CERT/CCid:VU#566640date:2002-01-15T00:00:00
db:CERT/CCid:VU#651994date:2001-06-26T00:00:00
db:CERT/CCid:VU#315308date:2002-03-05T00:00:00
db:BIDid:5114date:2002-06-27T00:00:00
db:CNNVDid:CNNVD-200505-1066date:2005-10-20T00:00:00
db:NVDid:CVE-2005-1609date:2017-07-11T01:32:00

SOURCES RELEASE DATE
db:CERT/CCid:VU#290140date:2002-06-27T00:00:00
db:CERT/CCid:VU#13877date:2001-11-07T00:00:00
db:CERT/CCid:VU#812438date:2005-05-11T00:00:00
db:CERT/CCid:VU#25309date:2000-09-26T00:00:00
db:CERT/CCid:VU#945216date:2001-10-24T00:00:00
db:CERT/CCid:VU#566640date:2001-07-12T00:00:00
db:CERT/CCid:VU#651994date:2001-05-16T00:00:00
db:CERT/CCid:VU#315308date:2001-01-18T00:00:00
db:BIDid:5114date:2002-06-27T00:00:00
db:CNNVDid:CNNVD-200505-1066date:2005-05-16T00:00:00
db:NVDid:CVE-2005-1609date:2005-05-16T04:00:00