Vulnerabilities > CVE-2008-0535 - Credentials Management vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remote attackers to cause a denial of service (device instability) via "SSH credentials that attempt to change the authentication method," aka Bug ID CSCsm14239.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 1 |
Common Weakness Enumeration (CWE)
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 29316 CVE(CAN) ID: CVE-2008-0534,CVE-2008-0535,CVE-2008-0536 Cisco服务控制引擎（SCE）设备提供高性能的高级应用层带宽优化、状态应用检查、基于会话的分类和网络通讯控制等功能。 * SSH登录行为漏洞 在SSH登录行为期间可能触发影响SCE SSH服务器的漏洞，导致系统不稳定或SCE重载。如果在积极间隔期间调用了特定的SSH进程的话，就会导致临时的资源不可用。 这个漏洞在Cisco Bug ID中记录为CSCsi68582，所分配的CVE ID为CVE-2008-0534。 * SSH登录行为导致非法输入/输出操作 与其他管理任务结合出现的到SCE管理接口的正常SSH通讯可能触发SCE SSH服务器中的第二个漏洞。在这个事件期间，非法的IO操作可能影响SCE管理代理，要求重启SCE才能恢复管理访问。 这个漏洞在Cisco Bug ID中记录为CSCsh49563，所分配的CVE ID为CVE-2008-0536。 * SCE SSH认证序列异常 在SSH认证过程中可能会触发SCE SSH服务器中的第三个漏洞，但与登录尝试频率或其他并行管理任务无关。可使用试图更改认证方式的特殊SSH凭据来触发这个漏洞，导致认证序列异常，影响系统稳定性。 这个漏洞在Cisco Bug ID中记录为CSCsm14239，所分配的CVE ID为CVE-2008-0535。 Cisco SCOS 3.0 Cisco SCOS 2.0 Cisco SCOS 1.0 Cisco SCE 2000 Cisco SCE 1000 Cisco ----- Cisco已经为此发布了一个安全公告（cisco-sa-20080521-sce）以及相应补丁: cisco-sa-20080521-sce：Cisco Service Control Engine Denial of Service Vulnerabilities 链接：<a href=http://www.cisco.com/warp/public/707/cisco-sa-20080521-sce.shtml target=_blank>http://www.cisco.com/warp/public/707/cisco-sa-20080521-sce.shtml</a> 补丁下载： <a href=http://www.cisco.com/pcgi-bin/tablebuild.pl/scos target=_blank>http://www.cisco.com/pcgi-bin/tablebuild.pl/scos</a> |
| id | SSV:3329 |
| last seen | 2017-11-19 |
| modified | 2008-05-24 |
| published | 2008-05-24 |
| reporter | Root |
| title | Cisco服务控制引擎SSH服务器多个拒绝服务漏洞 |
References
- http://secunia.com/advisories/30316
- http://secunia.com/advisories/30590
- http://securitytracker.com/id?1020074
- http://www.cisco.com/en/US/products/products_security_advisory09186a008099bf65.shtml
- http://www.icon-labs.com/news/read.asp?newsID=77
- http://www.kb.cert.org/vuls/id/626979
- http://www.securityfocus.com/bid/29316
- http://www.securityfocus.com/bid/29609
- http://www.vupen.com/english/advisories/2008/1604/references
- http://www.vupen.com/english/advisories/2008/1774/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42567