CVE-2008-5161 - SSH Server CBC Mode Ciphers Enabled

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

A security finding is showing that the servers are using vulnerable ciphers, specifically cipher block chaining.  

Finding Name	Synopsis	Description	Solution	Details
SSH Server CBC Mode Ciphers Enabled	The SSH server is configured to use Cipher Block Chaining.	The SSH server is configured to support Cipher Block Chaining (CBC) encryption.  This may allow an attacker to recover the plaintext message from the ciphertext. Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.	Contact the vendor or consult product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.	The following client-to-server Cipher Block Chaining (CBC) algorithms are supported :   3des-cbc   aes128-cbc   aes192-cbc   aes256-cbc   [email protected] The following server-to-client Cipher Block Chaining (CBC) algorithms are supported :   3des-cbc   aes128-cbc   aes192-cbc   aes256-cbc   [email protected]

Cause

CVE-2008-5161 (SSH Server CBC Mode Ciphers Enabled) which was addressed in the initial release of vAPP 14.2. As of 14.2, CBC ciphers are disabled in sshd.

Environment

Release : 14.2

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Resolution

The vulnerability was addressed in the initial release of vAPP 14.2. As of 14.2, CBC ciphers are disabled in sshd.