Cisco Warns of regreSSHion RCE Impacting Multiple Products

Cisco has issued a security advisory relating to a excessive far flung code execution (RCE) vulnerability, dubbed “regreSSHion,” that has effects on extra than one merchandise.

The vulnerability tracked as CVE-2024-6387, was as soon as disclosed by the Qualys Threat Research Unit on July 1, 2024. It impacts the OpenSSH server (sshd) in glibc-basically based fully Linux systems and has the aptitude to enable unauthenticated attackers to manufacture root rating valid of entry to to affected systems.

Vulnerability Details

The regreSSHion vulnerability is a regression of an older flaw (CVE-2006-5051) that was as soon as reintroduced in OpenSSH version 8.5p1, launched in October 2020.

The flaw entails a hotfoot situation in the sshd’s SIGALRM handler, which calls functions that are likely to be not async-signal-protected, equivalent to syslog().

An attacker can exploit this by opening extra than one connections and failing to authenticate eventually of the LoginGraceTime duration, triggering the susceptible signal handler asynchronously.

Cisco has identified several merchandise all over deal of categories tormented by this vulnerability.

The corporate is actively investigating its product line to resolve the fleshy scope of impacted devices. The following desk lists the affected merchandise and their respective Cisco Bug IDs:

Mitigation and Suggestions

Cisco recommends several steps to mitigate the menace of exploitation:

• Restrict SSH Catch entry to: Restrict SSH rating valid of entry to to relied on hosts handiest. This can also be performed by making boom of infrastructure rating valid of entry to manage lists (ACLs) to forestall unauthorized rating valid of entry to to SSH companies.
• Upgrade OpenSSH: Upgrade to the hottest patched version of OpenSSH (9.8p1) as quickly as it turns into readily available in the package deal repositories of Linux distributions.
• Modify LoginGraceTime: Characteristic the LoginGraceTime parameter to 0 in the sshd configuration file to forestall the hotfoot situation, even supposing this could possibly lead to denial-of-carrier if all connection slots change into occupied[1][6][7].

The Cisco Product Security Incident Response Team (PSIRT) is conscious of that a proof-of-belief exploit code is like a flash available for this vulnerability. Nonetheless, the exploitation requires customization, and there were no experiences of malicious boom.

Cisco continues to evaluate all merchandise and companies for affect and can exchange the advisory as novel data turns into readily available.

The regreSSHion vulnerability poses a vital menace to a enormous different of Cisco merchandise.

Customers are educated to discover Cisco’s solutions and discover the significant patches and mitigations to provide protection to their systems from doable exploitation.