OpenSSH verify_host_key function sshfp dns rr Check Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
OpenSSH <6.6
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-2653
 
OpenSSH is an open-source implementation of the SSH protocol.
 
In OpenSSH 6.6 and earlier versions, sshconnect. the function verify_host_key in c has a security vulnerability in implementation. This allows remote services to skip the sshfp dns rr check by submitting an unacceptable HostCertificate.
 
<* Source: Matthew Vernon
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
OpenSSH
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.openssh.com/

OpenSSH details: click here
OpenSSH: click here

Solve the latency problem during remote login through OpenSSH

Offline installation of OpenSSH in Ubuntu 12.10

OpenSSH upgrade steps and precautions

Solutions for failures of common OpenSSH users

General thread: OpenSSH key management, Part 1 Understanding RSA/DSA authentication

Install OpenSSH and configure the sftp lock directory for RedHat