CVE-1999-1085
First published: Fri Jun 12 1998(Updated: )
SSH 1.2.25, 1.2.23, and other versions, when used in in CBC (Cipher Block Chaining) or CFB (Cipher Feedback 64 bits) modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, aka the "SSH insertion attack."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SSH (Secure Shell) | =1.2.25 | |
| SSH (Secure Shell) | =1.2.23 | |
| GE Web Server | ||
| GE Access | ||
| GE Access | ||
| GE Access | ||
| GE Access | ||
| GE UR bootloader binary |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-1999-1085?
CVE-1999-1085 is considered a moderate severity vulnerability affecting SSH versions 1.2.25 and 1.2.23.
How do I fix CVE-1999-1085?
To mitigate CVE-1999-1085, upgrade to a patched version of SSH that is not vulnerable to known plaintext attacks.
What versions of SSH are affected by CVE-1999-1085?
CVE-1999-1085 affects SSH versions 1.2.25, 1.2.23, and potentially other SSH implementations in CBC or CFB mode.
Can CVE-1999-1085 be exploited remotely?
Yes, CVE-1999-1085 can be exploited remotely by an attacker who can inject arbitrary data into the SSH stream.
What types of attacks are possible with CVE-1999-1085?
CVE-1999-1085 allows for known plaintext attacks which can compromise the integrity of the data sent over SSH.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- agent/trending
- agent/source
- collector/nvd-historical
- vendor/ssh
- product/secure shell
- canonical/ssh secure shell
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/ics-cert-advisory
- source/ICS
- canonical/ssh (secure shell)
- version/ssh (secure shell)/1.2.25
- version/ssh (secure shell)/1.2.23
- vendor/ge
- canonical/ge web server
- canonical/ge access
- canonical/ge ur bootloader binary