Cisco IOS XR Software SSHv1 Denial of Service Vulnerability
25 Oct. 2011
Summary
Cisco IOS XR Software contains a vulnerability in the SSH application that may result in a denial of service condition when the SSH version 1 (SSHv1) protocol is used.
Vulnerable Systems:
* Cisco IOS XR Software with SSH enabled
Immune Systems:
* Cisco IOS Software
* Cisco IOS XR Software without SSH enabled
* Cisco IOS XR Software configured to accept only SSHv2 connections
The vulnerability is a result of unremoved sshd_lock files consuming all available space in the /tmp filesystem.
This vulnerability affects Cisco IOS XR devices that are running affected software releases and are configured to accept SSHv1 connections. When an SSHv1 connection is made to the SSH server that is running on a Cisco IOS XR device, a file is created in the /tmp directory. This file begins with the text "sshd_lock" and may not be properly removed when the session ends. Multiple connections may consume all available space in the /tmp filesystem and cause the system to crash, leading to a denial of service condition.
Successful exploitation of this vulnerability may cause the Cisco IOS XR device to crash, resulting in a denial of service condition.
Workaround:
SSHv1 can be disabled by configuring the SSH server to only accept SSHv2 connections. In order to configure a device to only accept SSHv2 connections, administrators can issue the command ssh server v2. Administrators should manually remove lock files after disabling SSHv1 or after the server is upgraded to a non-vulnerable version. The command run rm /tmp/sshd_lock* will delete any sshd_lock files on the system.
