The SSH, remote access service of the ACOS management interface include support for weak ciphers and MAC algorithms. Accordingly, the following vulnerabilities are addressed in this document.
|1||A10-2017-0001 (a)||A10||n/a||SSH - SHA2 HMACs for stronger security|
|2||CVE-2008-5161||CVSS 2.0||2.6 Low||SSH Server CBC Mode Ciphers Enabled |
|3||71049||Nessus||2.6 Low||SSH Weak MAC Algorithms Enabled |
(a) A10 Networks, Inc. assigned identifier.
The table below indicates releases of ACOS exposed to these vulnerabilities and ACOS releases that address these issues or are otherwise unaffected by them.
Customers using affected ACOS releases can overcome vulnerability exposures by updating to the indicated resolved release. If the table does not list a corresponding resolved or unaffected release, then no ACOS release update is currently available.
|Releases Affected||Releases Resolved or Unaffected|
|4.1.1 – 4.1.1-P2||4.1.1-P3|
|4.1.0 – 4.1.0-P8||4.1.0-P9|
|3.1.0-P1 – 3.2.1-P1||3.2.2-P1|
|2.8.2 – 2.8.2-P7||2.8.2-P8|
|2.7.2 – 2.7.2-P11||4.1.2-P1|
|2.7.1 – 2.7.1-GR1-P1||4.1.0-P9, 4.1.1-P2|
|2.6.1-GR1 – 2.6.1-GR1-P16||4.1.0-P9, 4.1.1-P2|
Common security best practices in the industry for network appliance management and control planes can enhance protection against remote malicious attacks. Limit the exploitable attack surface for critical, infrastructure, networking equipment through the use of access lists or firewall filters to and from only trusted, administrative networks or hosts.
Software updates that address these vulnerabilities are or will be published at the following URL:
The following table shares brief descriptions for the vulnerabilities addressed in this document.
|A10-2017-0001||The remote SSH server is configured to allow additionally support SHA2 HMACs for improved security and increased compatibility with contemporary security profiles.|
|CVE-2008-5161||Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.|
|71049||The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak.|
|Ref #||General Link|
|||Nessus: SSH Weak MAC Algorithms Enabled|
|||NIST NVD, CVE-2008-5161|