SA104 : OpenSSH Vulnerabilities

SUMMARY

Blue Coat products using affected versions of OpenSSH are susceptible to multiple vulnerabilities. An attacker, with access to the management interface, may exploit these vulnerabilities to conduct brute-force password guessing attacks, bypass access restrictions, log in as a different user, achieve privilege escalation, execute arbitrary code, and force SSH clients to skip security checks. The attacker can also cause denial of service due to memory corruption and illegal memory accesses.

AFFECTED PRODUCTS

The following products are vulnerable:

Advanced Secure Gateway (ASG)

CVE |Affected Version(s)|Remediation
All CVEs | 6.7 and later | Not vulnerable, fixed in 6.7.2.1
CVE-2014-2653 | 6.6 | Upgrade to 6.6.3.1.
CVE-2014-2532 | 6.6 (not vulnerable to known vectors of attack) | Upgrade to 6.6.3.1.
CVE-2015-5600, CVE-2015-6563,
CVE-2015-6564 | 6.6 (not vulnerable to known vectors of attack) | Upgrade to 6.6.5.1.

Content Analysis System (CAS)

CVE |Affected Version(s)|Remediation
All CVEs | 2.1 and later | Not vulnerable, fixed in 2.1.1.1
CVE-2014-2532, CVE-2014-2653 | 1.3 | Upgrade to 1.3.6.1.
1.1, 1.2 | Upgrade to later release with fixes.
CVE-2015-6563, CVE-2015-6564 | 1.3 | Upgrade to 1.3.7.1.
1.1, 1.2 | Upgrade to later release with fixes.
CVE-2015-5352, CVE-2015-5600 | 1.3 (not vulnerable to known vectors of attack) | Upgrade to 1.3.7.1.
1.1, 1.2 (not vulnerable to known vectors of attack0 | Upgrade to later release with fixes.

Director

CVE |Affected Version(s)|Remediation
CVE-2014-2532, CVE-2014-2653,
CVE-2015-5600, CVE-2015-6563,
CVE-2015-6564 | 6.1 | Upgrade to 6.1.22.1.

Mail Threat Defense (MTD)

CVE |Affected Version(s)|Remediation
CVE-2015-6563, CVE-2015-6564 | 1.1 | Not available at this time
CVE-2015-5600 | 1.1 (not vulnerable to known vectors of attack) | Upgrade to 1.1.2.1.
CVE-2015-5352 | 1.1 (not vulnerable to known vectors of attack) | Not available at this time

Malware Analysis Appliance (MAA)

CVE |Affected Version(s)|Remediation
CVE-2014-2532, CVE-2014-2653,
CVE-2015-5600, CVE-2015-6563,
CVE-2015-6564 | 4.2 | Upgrade to 4.2.8.

Management Center (MC)

CVE |Affected Version(s)|Remediation
CVE-2014-2532, CVE-2014-2653 | 1.5 and later | Not vulnerable, fixed in 1.5.1.1
1.4 | Upgrade to later release with fixes.
CVE-2015-6563, CVE-2015-6564 | 1.6 and later | Not vulnerable, fixed in 1.6.1.1
1.4, 1.5 | Upgrade to later release with fixes.

Norman Shark Industrial Control System Protection (ICSP)

CVE |Affected Version(s)|Remediation
CVE-2015-5352, CVE-2015-5600,
CVE-2015-6563, CVE-2015-6564 | 5.4 | Not vulnerable, fixed in 5.4.1
5.3 | Upgrade to 5.3.6.

Norman Shark Network Protection (NNP)

CVE |Affected Version(s)|Remediation
CVE-2015-5352, CVE-2015-5600,
CVE-2015-6563, CVE-2015-6564 | 5.3 | Upgrade to 5.3.6.

Norman Shark SCADA Protection (NSP)

CVE |Affected Version(s)|Remediation
CVE-2015-5352, CVE-2015-5600,
CVE-2015-6563, CVE-2015-6564 | 5.3 | Upgrade to 5.3.6.

PacketShaper (PS) S-Series

CVE |Affected Version(s)|Remediation
All CVEs | 11.6 and later | Not vulnerable, fixed in 11.6.1.1
CVE-2014-2532, CVE-2015-5600 | 11.5 | Upgrade to 11.5.2.1.
11.2, 11.3, 11.4 | Upgrade to later release with fixes.
CVE-2015-6563, CVE-2015-6564 | 11.5 | Upgrade to 11.5.3.2.
11.2, 11.3, 11.4 | Upgrade to later release with fixes.

PolicyCenter (PC) S-Series

CVE |Affected Version(s)|Remediation
CVE-2015-6563, CVE-2015-6564 | 1.1 | Upgrade to 1.1.2.2.

Reporter

CVE |Affected Version(s)|Remediation
CVE-2014-2532, CVE-2014-2653 | 10.2 and later | Not vulnerable, fixed in 10.2.1.1
10.1 (not vulnerable to known vectors of attack) | Upgrade to 10.1.3.1.
CVE-2014-9278 | 10.1 and later | Not vulnerable
CVE-2015-5352, CVE-2015-5600 | 10.2 and later | Not vulnerable, fixed in 10.2.1.1
10.1 (not vulnerable to known vectors of attack) | Upgrade to 10.1.4.2.
CVE-2015-6563, CVE-2015-6564 | 10.2 and later | Not vulnerable, fixed in 10.2.1.1
10.1 | Upgrade to 10.1.4.2.
All CVEs | 9.4, 9.5 | Not vulnerable

Security Analytics (SA)

CVE |Affected Version(s)|Remediation
CVE-2014-2532 | 7.2 and later | Not vulnerable, fixed in 7.2.1
7.1 | Upgrade to 7.1.11.
7.0 | Upgrade to later release with fixes.
6.6 | Upgrade to 6.6.12.
CVE-2014-2653,
CVE-2015-5600, CVE-2015-6563,
CVE-2015-6564 | 7.2 and later | Not vulnerable, fixed in 7.2.1
7.1 | Upgrade to 7.1.11.
7.0 | Upgrade to later release with fixes.
6.6 | Upgrade to 6.6.12.
CVE-2015-5352 | 7.2 and later | Not vulnerable, fixed in 7.2.1
7.1 (not vulnerable to known vectors of attack) | Apply patch RPM available from customer support.
7.0 (not vulnerable to known vectors of attack) | Upgrade to later release with fixes.
6.6 (not vulnerable to known vectors of attack) | Apply patch RPM available from customer support.

SSL Visibility (SSLV)

CVE |Affected Version(s)|Remediation
CVE-2015-6563, CVE-2015-6564 | 3.10 and later | Fixed in 3.10.1.1
3.9 | Upgrade to 3.9.3.6.
3.8.4FC | Upgrade to 3.8.4FC-55.
3.8 | Upgrade to later release with fixes.

X-Series XOS

CVE |Affected Version(s)|Remediation
CVE-2014-2532, CVE-2014-2653,
CVE-2015-5600, CVE-2015-6563,
CVE-2015-6564 | 11.0 | Not available at this time
10.0 | Not available at this time
9.7 | Not available at this time

ADDITIONAL PRODUCT INFORMATION

In SSL Visibility, the OpenSSH vulnerabilities can be exploited only the product's management interfaces (web UI, CLD). Limiting the machines, IP addresses and subnets able to reach this physical network port reduces the threat. This reduces the CVSS v2 scores for multiple CVEs. The adjusted CVSS v2 base scores and severity are:

• CVE-2014-2532 - 4.3 (MEDIUM) (AV:A/AC:M/Au:N/C:P/I:P/A:N)
• CVE-2014-2653 - 4.3 (MEDIUM) (AV:A/AC:M/Au:N/C:P/I:P/A:N)
• CVE-2015-5352 - 2.9 (LOW) (AV:A/AC:M/Au:N/C:N/I:P/A:N)
• CVE-2015-5600 - 6.8 (MEDIUM) (AV:A/AC:L/Au:N/C:P/I:N/A:C)

Blue Coat products do not enable or use all functionality within OpenSSH. Products that do not utilize or enable the functionality described in a CVE are not vulnerable to that CVE. However, fixes for those CVEs will be included in the patches that are provided. The following products include vulnerable versions of OpenSSH, but do not use the functionality described in the CVEs and are not known to be vulnerable.

• ASG: CVE-2014-2532, CVE-2015-5600, CVE-2015-6563, and CVE-2015-6564
• CAS: CVE-2015-5352 and CVE-2015-5600
• Director: CVE-2015-5352
• MAA: CVE-2015-5352
• MTD: CVE-2015-5352 and CVE-2015-5600
• MC: CVE-2015-5352 and CVE-2015-5600
• PS S-Series: CVE-2014-2653 and CVE-2015-5352
• PC S-Series: CVE-2015-5352
• Reporter 10.1: CVE-2014-2532, CVE-2014-2653, CVE-2015-5352, and CVE-2015-5600
• Security Analytics: CVE-2015-5352
• SSLV: CVE-2014-2653, CVE-2015-5352, and CVE-2015-5600
• XOS: CVE-2015-5352

The following products are not vulnerable:
Android Mobile Agent
AuthConnector
BCAAA
Blue Coat HSM Agent for the Luna SP
CacheFlow
Client Connector
Cloud Data Protection for Salesforce
Cloud Data Protection for Salesforce Analytics
Cloud Data Protection for ServiceNow
Cloud Data Protection for Oracle CRM On Demand
Cloud Data Protection for Oracle Field Service Cloud
Cloud Data Protection for Oracle Sales Cloud
Cloud Data Protection Integration Server
Cloud Data Protection Communication Server
Cloud Data Protection Policy Builder
General Auth Connector Login Application
IntelligenceCenter
IntelligenceCenter Data Collector
K9
PacketShaper
PolicyCenter
ProxyAV
ProxyAV ConLog and ConLogXP
ProxyClient
ProxySG
Unified Agent
Web Isolation

Blue Coat no longer provides vulnerability information for the following products:

DLP
Please, contact Digital Guardian technical support regarding vulnerability information for DLP.

ISSUES

CVE-2014-1692

Severity / CVSSv2 | High / 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) References| SecurityFocus: BID 65230 / NVD: CVE-2014-1692 Impact| Denial of service, unspecified other impact Description | A flaw allows an attacker to cause memory corruption, resulting in a denial of service or unspecified other impact.

CVE-2014-2532

Severity / CVSSv2 | Medium / 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) References| SecurityFocus: BID 66355 / NVD: CVE-2014-2532 Impact| Security control bypass Description | A flaw allows an attacker to pass environment variables to a server SSH session and bypass intended environment variable restrictions.

CVE-2014-2653

Severity / CVSSv2 | Medium / 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) References| SecurityFocus: BID 66459 / NVD: CVE-2014-2653 Impact| Security control bypass Description | A flaw allows an attacker to cause SSH clients to skip SSHFP DNS record checks when establishing SSH connections.

CVE-2014-9278

Severity / CVSSv2 | Medium / 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N) References| SecurityFocus: BID 71420 / NVD: CVE-2014-9278 Impact| Security control bypass Description | A flaw allows a remote attacker in a Kerberos environment to log in as a different user if changing users is allowed only after local authentication.

CVE-2015-5352

Severity / CVSSv2 | Medium / 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) References| SecurityFocus: BID 75525 / NVD: CVE-2015-5352 Impact| Security control bypass Description | A flaw allows an attacker to bypass intended time window access restrictions when establishing X11 connections to SSH clients.

CVE-2015-5600

Severity / CVSSv2 | High / 8.5 (AV:N/AC:L/Au:N/C:P/I:N/A:C) References| SecurityFocus: BID 75990 / NVD: CVE-2015-5600 Impact| Information disclosure Description | A flaw allows an attacker to conduct brute-force password guessing attacks or cause denial of service in SSH servers that use keyboard interactive authentication.

CVE-2015-6563

Severity / CVSSv2 | Low / 1.9 (AV:L/AC:M/Au:N/C:N/I:P/A:N) References| SecurityFocus: BID 76317 / NVD: CVE-2015-6563 Impact| Privilege escalation Description | A flaw allows a local attacker with valid user credentials to achieve privilege escalation if the attacker has already compromised a local non-privileged pre-authentication process.

CVE-2015-6564

Severity / CVSSv2 | Medium / 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C) References| SecurityFocus: BID 76317 / NVD: CVE-2015-6564 Impact| Denial of service, privilege escalation Description | A flaw allows a local attacker to cause the SSH daemon to crash or execute arbitrary code with root privileges if the attacker has already compromised a local non-privileges pre-authentication process.

CVE-2015-6565

Severity / CVSSv2 | High / 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C) References| SecurityFocus: BID 76497 / NVD: CVE-2015-6565 Impact| Denial of service, unspecified other impact Description | A flaw that allows a local attacker to cause denial-of-service or have unspecified other impact through writing to TTY device files.

MITIGATION

These vulnerabilities can be exploited only through the management interfaces for all vulnerable products. Allowing only machines, IP addresses and subnets from a trusted network to access the management interface reduces the threat of exploiting the vulnerabilities.

By default, Director does not configure its OpenSSH software to accept environment variables from clients or to use keyboard interactive authentication. Customers who leave this default behavior unchanged prevent attacks against Director using CVE-2014-2532 and CVE-2015-5600.

By default, MAA does not use SSH as a client, does not use SSH in a Kerberos environment, and does not configure its OpenSSH software to use keyboard interactive authentication. Customers who leave this default behavior unchanged prevent attacks against MAA using CVE-2014-2653 and CVE-2015-5600.

By default, Security Analytics does not use SSH in a Kerberos environment. Also, it does not configure its OpenSSH software to accept environment variables from clients or to use keyboard interactive authentication. Customers who leave this default behavior unchanged prevent attacks against Security Analytics using CVE-2014-2532 and and CVE-2015-5600.

By default, XOS does not use SSH as a client and does not configure its OpenSSH software to accept environment variables from clients or to use keyboard interactive authentication. Customers who leave this default behavior unchanged prevent attacks against XOS using CVE-2014-2532, CVE-2014-2653, CVE-2015-5600.

REFERENCES

OpenSSH security announcements - <https://www.openssh.com/security.html&gt;

REVISION

2020-04-20 Security Analytics 7.3, 8.0, and 8.1 are not vulnerable to CVE-2014-2532. Industrial Control System Protection (ICSP) 5.4 is not vulnerable because a fix is available in 5.4.1. Advisory status moved to Closed.
2019-10-02 Web Isolation is not vulnerable.
2019-08-29 Reporter 10.3 and 10.4 have vulnerable versions of OpenSSH for CVE-2014-2532, but are not vulnerable to known vectors of attack.
2019-01-20 SA 7.3 starting with 7.3.2 and 8.0 are vulnerable to CVE-2014-2532.
2018-04-25 A fix for XOS 9.7 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2018-04-22 PacketShaper S-Series 11.10 is not vulnerable.
2017-11-06 ASG 6.7 is not vulnerable because a fix is available in 6.7.2.1.
2017-08-02 SSLV 4.1 is not vulnerable.
2017-07-24 PacketShaper S-Series 11.9 is not vulnerable.
2017-07-20 MC 1.10 is not vulnerable.
2017-06-22 Security Analytics 7.3 is not vulnerable.
2017-06-05 PacketShaper S-Series 11.8 is not vulnerable.
2017-05-17 CAS 2.1 is not vulnerable.
2017-03-06 MC 1.8 is not vulnerable. SSLV 4.0 is not vulnerable. Vulnerability inquiries for DLP should be addressed to Digital Guardian technical support.
2017-02-16 Previously, it was reported that Security Analytics by default is not vulnerable to CVE-2014-2653 because it does not act as an SSH client. Further investigation has shown that Security Analytics acts as an SSH client and is vulnerable to CVE-2014-2653 by default.
2016-11-29 A fix for Director is available in 6.1.22.1. PacketShaper S-Series 11.7 is not vulnerable. SSLV 3.11 is not vulnerable.
2016-11-17 Cloud Data Protection for Oracle Field Service Cloud is not vulnerable.
2016-11-08 A fix for all CVEs in ASG is available in 6.6.5.1.
2016-11-07 SSLV 3.10 is not vulnerable
2016-09-22 A fix for all CVEs in Reporter 10.1 is available in 10.1.4.2. MC 1.6 and 1.7 are not vulnerable because they have the vulnerability fixes. Further vulnerability fixes for MC 1.4 and 1.5 will not be provided. Please upgrade to the latest MC version with the vulnerability fixes.
2016-09-01 A fix for SSLV 3.8.4FC is available in 3.8.4FC-55.
2016-08-12 A fix for all CVEs in CAS 1.3 is available in 1.3.7.1. Security Analytics 7.2 is not vulnerable.
2016-06-30 PacketShaper S-Series is not vulnerable.
2016-06-28 Fixed typos in Affected Products, Advisory Details, and Patches sections.
2016-06-27 Fixes will not be provided for PacketShaper S-Series 11.2, 11.3, and 11.4. Please upgrade to a later version with the vulnerability fixes.
2016-06-24 A fix for CVE-2014-2653 in PS S-Series is available in 11.5.2.1. A fix for all CVEs in PS S-Series is available in 11.5.3.2. A fix for PC S-Series is available in 1.1.2.2.
2016-06-22 A fix for CVE-2014-2532 is available in ASG 6.6.3.1.
2016-06-22 Previously, it was reported that ASG 6.6 is not vulnerable to CVE-2014-2532, CVE-2015-5600, CVE-2015-6563, and CVE-2015-6564. Further investigation has shown that ASG 6.6 has a vulnerable version of OpenSSH for multiple CVEs, but is not vulnerable to known vectors of attack.
2016-06-16 PC S-Series is vulnerable to CVE-2015-6563 and CVE-2015-6564. It also has vulnerable code for CVE-2015-5352, but is not vulnerable to known vectors of attack. A fix is not available at this time.
2016-06-14 A fix for SA 7.0 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2016-06-13 Fixes for ICSP, NNP, and NSP are available in 5.3.6.
2016-05-26 Fixes for CVE-2015-5352 in Security Analytics 6.6 and 7.1 are available through patch RPMs from Blue Coat Support.
2016-05-19 Fixes for all CVEs except CVE-2015-5352 are available in Security Analytics 6.6.12 and 7.1.11.
2016-05-11 No Cloud Data Protection products are vulnerable.
2016-04-27 A fix for CVE-2015-5600 in MTD 1.1 is available in 1.1.2.1.
2016-04-24 MTD 1.1 is vulnerable to CVE-2015-6563 and CVE-2015-6564. It also have vulnerable code for CVE-2015-5352 and CVE-2015-5600, but is not vulnerable to known vectors of attack.
2016-04-22 It was previously reported that Security Analytics 6.6, 7.0, and 7.1 are vulnerable to CVE-2014-9278, and that Reporter 10.1 has vulnerable code for CVE-2014-9278. New information indicates that SA and Reporter are not vulnerable to this CVE.
2016-04-19 Fixes for CVE-2014-2532 and CVE-2015-5600 in PS S-Series 11.5 are available in 11.5.2.1.
2016-04-15 Fixes will not be provided for CAS 1.1 and 1.2. Please upgrade to a later version with the vulnerability fixes.
2016-03-14 A fix for CVE-2014-2532 and CVE-2014-2653 in CAS 1.3 is available in 1.3.6.1.
2016-03-10 A fix for MAA 4.2 is available in 4.2.8. It was previously reported that MAA 4.2 is vulnerable to CVE-2014-9278, but further investigation has shown that it is not vulnerable to that CVE.
2016-03-04 A fix for CVE-2014-2532 and CVE-2014-2653 is available in Reporter 10.1.3.1.
2016-01-21 A fix for SSLV 3.9 is available.
2016-01-15 A fix for SSLV 3.8 will not be provided. Please upgrade to a later version with the vulnerability fixes.
2015-12-22 MC 1.5 contains fixes for CVE-2014-2532 and CVE-2014-2653. It is vulnerable to or has vulnerable code for other CVEs, and fixes are pending.
2015-12-21 CAS, Director, MAA, MC, PacketShaper, Reporter 10.1, Security Analytics, SSLV, and XOS have vulnerable OpenSSH software, but do not use the vulnerable functionality and are not known to be vulnerable. The vulnerable software will be patched in future releases.
2015-12-10 Security Analytics 6.6, 7.0, and 7.1 are vulnerable.
2015-12-09 initial public release