Bug 660642 – CVE-2010-4478 openssh: J-PAKE authentication bypass

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 660642 - (CVE-2010-4478) CVE-2010-4478 openssh: J-PAKE authentication bypass

Summary:	CVE-2010-4478 openssh: J-PAKE authentication bypass

Status:	CLOSED NOTABUG

Aliases:	CVE-2010-4478

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	Unspecified Unspecified

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,source=internet,repo...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2010-12-07 08:03 EST by Tomas Hoger
Modified:	2016-09-14 08:28 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2010-12-07 08:05:11 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Tomas Hoger 2010-12-07 08:03:26 EST

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4478 to the following vulnerability:

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.

References:
http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf
https://github.com/seb-m/jpake
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c#rev1.5

Comment 1 Tomas Hoger 2010-12-07 08:05:11 EST

As noted in Sébastien Martini's paper, J-PAKE support in OpenSSH is experimental work-in-progress.  It's not enabled in Red Hat Enterprise Linux and Fedora openssh packages.

Statement:

Not vulnerable. This issue did not affect the versions of openssh as shipped with Red Hat Enterprise Linux 4, 5, or 6.

Note You need to log in before you can comment on or make changes to this bug.