CVE-1999-1010: Low severity OpenBSD OpenSSH vulnerability
An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
OpenSSH 1.2.27from your environment.Disable or uninstall the affected OpenSSH 1.2.27 server until a security update or patch is available.
- Configuration
Remove 'none' from the server's accepted ciphers (e.g., remove 'none' from the Ciphers list in sshd_config) or otherwise configure the server to not accept the 'none' cipher.
OpenSSH Ciphers = exclude 'none' - Compensating control
Restrict network access to affected OpenSSH 1.2.27 servers using firewall rules or ACLs (allow only trusted IPs or place behind a VPN) and isolate the service until a fix is applied.
- Operational
Monitor SSH logs for any connections negotiating the 'none' cipher, terminate such sessions, investigate potential misuse, and rotate any credentials or keys if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1010?
CVE-1999-1010 is classified as a medium severity vulnerability.
How do I fix CVE-1999-1010?
To fix CVE-1999-1010, configure the SSH server to disable the 'none' cipher usage.
Which software versions are affected by CVE-1999-1010?
CVE-1999-1010 specifically affects OpenSSH version 1.2.27.
What are the risks of CVE-1999-1010?
The primary risk of CVE-1999-1010 is that it allows for weaker encryption methods, potentially exposing data to interception.
Is CVE-1999-1010 still relevant today?
While CVE-1999-1010 is an older vulnerability, it highlights historical weaknesses in SSH implementations that can inform current security practices.