Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477) - Nessus

Critical   Plugin ID: 11383

---

This page contains detailed information about the Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 11383
Name: Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477)
Filename: CSCdz60229.nasl
Vulnerability Published: 2002-12-16
This Plugin Published: 2003-03-14
Last Modification Time: 2018-06-27
Plugin Version: 1.29
Plugin Type: local
Plugin Family: CISCO
Dependencies: snmp_cisco_type.nasl, snmp_sysDesc.nasl
Required KB Items [?]: CISCO/model, SNMP/community, SNMP/sysDesc

Vulnerability Information

---

Severity: Critical
Vulnerability Published: 2002-12-16
Patch Published: N/A
CVE [?]: CVE-2002-1357, CVE-2002-1358, CVE-2002-1359, CVE-2002-1360
CPE [?]: cpe:/o:cisco:ios

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

It is possible to make the remote IOS crash when sending it malformed SSH packets during the key exchange.

These flaws are documented as CISCO bug ID CSCdz60229, CSCdy87221 and CSCdu75477.

Solution

See http://www.nessus.org/u?aed52b80

Public Exploits

---

Target Network Port(s): N/A
Target Asset(s): N/A
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477) vulnerability:

1. Metasploit: exploit/windows/ssh/putty_msg_debug
   [PuTTY Buffer Overflow]
2. Exploit-DB: exploits/windows/remote/1788.pm
   [EDB-1788: PuTTy.exe 0.53 - Validation Remote Buffer Overflow (Metasploit)]
3. Exploit-DB: exploits/windows/remote/16463.rb
   [EDB-16463: PuTTy.exe 0.53 - Remote Buffer Overflow (Metasploit)]
4. GitHub: https://github.com/kaleShashi/PuTTY
   [CVE-2002-1357]
5. GitHub: https://github.com/pbr94/PuTTy-
   [CVE-2002-1357]
6. GitHub: https://github.com/kaleShashi/PuTTY
   [CVE-2002-1359]
7. GitHub: https://github.com/pbr94/PuTTy-
   [CVE-2002-1359]
8. GitHub: https://github.com/kaleShashi/PuTTY
   [CVE-2002-1360]
9. GitHub: https://github.com/pbr94/PuTTy-
   [CVE-2002-1360]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C

CVSS Base Score:	10.0 (High)
Impact Subscore:	10.0
Exploitability Subscore:	10.0
CVSS Temporal Score:	8.3 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	8.3 (High)

Go back to menu.

Plugin Source

---

This is the CSCdz60229.nasl nessus plugin source code. This script is (C) 2003-2018 Tenable Network Security, Inc.

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if(description)
{
 script_id(11383);
 script_version("1.29");
 script_cve_id("CVE-2002-1357", "CVE-2002-1358", "CVE-2002-1359", "CVE-2002-1360");
 script_bugtraq_id(6397, 6405, 6407, 6408, 6410);

 script_name(english:"Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477)");

 script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch." );
 script_set_attribute(attribute:"description", value:
"It is possible to make the remote IOS crash when sending
it malformed SSH packets during the key exchange.

These flaws are documented as CISCO bug ID CSCdz60229, CSCdy87221 and 
CSCdu75477." );
 script_set_attribute(attribute:"solution", value:
"See 
http://www.nessus.org/u?aed52b80" );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"metasploit_name", value:'PuTTY Buffer Overflow');
 script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
 script_cwe_id(20, 119);

 script_set_attribute(attribute:"plugin_publication_date", value: "2003/03/14");
 script_cvs_date("Date: 2018/06/27 18:42:25");
 script_set_attribute(attribute:"vuln_publication_date", value: "2002/12/16");
 script_set_attribute(attribute:"plugin_type", value:"local");
 script_set_attribute(attribute:"cpe", value: "cpe:/o:cisco:ios");
 script_end_attributes();

 script_summary(english:"Uses SNMP to determine if a flaw is present");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is (C) 2003-2018 Tenable Network Security, Inc.");
 script_family(english:"CISCO");
 script_dependencie("snmp_sysDesc.nasl", "snmp_cisco_type.nasl");
 script_require_keys("SNMP/community", "SNMP/sysDesc", "CISCO/model");
 exit(0);
}

# The code starts here

ok=0;
os = get_kb_item("SNMP/sysDesc"); if(!os)exit(0);
hardware = get_kb_item("CISCO/model"); if(!hardware)exit(0);

# Check for the required operating system...
#----------------------------------------------------------------
# Is this IOS ?
if(!egrep(pattern:".*(Internetwork Operating|IOS).*", string:os))exit(0);
# 12.0S
if(egrep(string:os, pattern:"((12\.0\(([0-9]|[1-1][0-9]|2[0-2])\)|12\.0)S[0-9]*|12\.0\(23\)S[0-1]),"))ok=1;

# 12.0ST
if(egrep(string:os, pattern:"((12\.0\(([0-9]|[1-1][0-9]|2[0-0])\)|12\.0)ST[0-9]*|12\.0\(21\)ST[0-5]),"))ok=1;

# 12.1E
if(egrep(string:os, pattern:"((12\.1\(([0-9]|1[0-3])\)|12\.1)E[0-9]*|12\.1\(14\)E[0-0]),"))ok=1;

# 12.1EA
if(egrep(string:os, pattern:"(12\.1\(([0-9]|1[0-2])\)|12\.1)EA[0-9]*,"))ok=1;

# 12.1T
if(egrep(string:os, pattern:"(12\.1\([0-9]*\)|12\.1)T[0-9]*,"))ok=1;

# 12.2
if(egrep(string:os, pattern:"(12\.2\(([0-9]|1[0-2])\)|12\.2),"))ok=1;

# 12.2S
if(egrep(string:os, pattern:"(12\.2\(([0-9]|1[0-3])\)|12\.2)S[0-9]*,"))ok=1;

# 12.2T
if(egrep(string:os, pattern:"((12\.2\(([0-9]|1[0-2])\)|12\.2)T[0-9]*|12\.2\(13\)T[0-0]),"))ok=1;


#----------------------------------------------

if(ok)security_hole(port:161, proto:"udp");

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/CSCdz60229.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\CSCdz60229.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/CSCdz60229.nasl

Go back to menu.

How to Run

---

Here is how to run the Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select CISCO plugin family.
6. On the right side table select Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477) plugin ID 11383.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl CSCdz60229.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a CSCdz60229.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - CSCdz60229.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state CSCdz60229.nasl -t <IP/HOST>

Go back to menu.

References

---

BID | SecurityFocus Bugtraq ID:

• 6397, 6405, 6407, 6408, 6410

CWE | Common Weakness Enumeration:

• CWE-20 (Weakness) Improper Input Validation
• CWE-119 (Weakness) Improper Restriction of Operations within the Bounds of a Memory Buffer

See also:

• https://www.tenable.com/plugins/nessus/11383
• https://vulners.com/nessus/CSCDZ60229.NASL

Similar and related Nessus plugins:

• 48968 - SSH Malformed Packet Vulnerabilities - Cisco Systems
• 11195 - SSH Multiple Remote Vulnerabilities

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file CSCdz60229.nasl version 1.29. For more plugins, visit the Nessus Plugin Library.

Go back to menu.