HPESBNW04669 rev.2 - Unauthenticated Remote Code Execution vulnerability in OpenSSH's Server (RegreSSHion)

VULNERABILITY SUMMARY

Title

Unauthenticated Remote Code Execution vulnerability in OpenSSH's Server (RegreSSHion)

Note: A signed text copy of this document exists at hpe_aruba_networking_-_hpesbnw04669.txt 

Note: A CSAF version of this document exists at hpe_aruba_networking_-_hpesbnw04669.json 

HPE Aruba Networking Product Security Advisory

Advisory ID: HPESBNW04669
CVE: CVE-2024-6387
Publication Date: 2024-Jul-10
Last Updated: 2024-Jul-31
Status: Confirmed
Severity: High
Revision: 2

Overview

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to OpenSSH sshd to handle some signals in an unsafe manner. An unauthenticated remote attacker may be able to trigger this vulnerability condition by failing to authenticate within a set time.

Affected Products

HPE Aruba Networking

Unaffected Products

HPE Aruba Networking

Other Aruba products not listed above are also not known to be affected by this vulnerability.

Product versions that are end of life are affected by this vulnerabilityunless otherwise indicated.

This advisory will be updated as further information becomes available.

Details

Race Condition in OpenSSH-server Leading to Unauthenticated Remote Code Execution (CVE-2024-6387)

A security regression of (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a
race condition which can lead to OpenSSH sshd to handle some signals in an unsafe manner. An
unauthenticated remote attacker may be able to trigger this vulnerable condition by failing to
authenticate within a set time.

Internal References: ASIRT-1745, ATLSP-117, ATLAX-82
ATLAM-11, ATLAM-12

Severity: High
CVSSv3.x Overall Score: 8.1
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Discovery: This vulnerability was discovered and reported
by the Qualys Threat Research Unit (TRU).

Workaround

To minimize the likelihood of an attacker exploiting this vulnerability, Aruba recommends that the ssh port on impacted devices be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.

For HPE Networking Instant On this vulnerability has no impact unless the support token is activated in cloud mode. Customers should disable use of the "support token" until 3.0.0 is released and updated.

Exploitation and Public Discussion

This CVE is being widely discussed in public. Public exploits are available for 32-bit linux systems based on glibc. 64-bit exploits are being developed. Please note that this is a high complexity attack that requires uninterrupted access to a vulnerable OpenSSH server to exploit. Conditions for exploiting this vulnerability are highly dependent upon the environment that vulnerable products are deployed into.

A blog describing this vulnerability is available at https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server

More in-depth technical detail and discussion is available at https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt