Terrapin attack in Apache MINA SSHD

1) Inadequate Encryption Strength

EUVDB-ID: #VU95799

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41909

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features and perform "Terrapin attack".

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Mina SSHD: 2.0.0 - 2.11.0

CPE2.3

• cpe:2.3:a:apache_foundation:apache_mina_sshd:2.0.0:*:*:*:*:mina:*:*
• cpe:2.3:a:apache_foundation:apache_mina_sshd:2.1.0:*:*:*:*:mina:*:*
• cpe:2.3:a:apache_foundation:apache_mina_sshd:2.2.0:*:*:*:*:mina:*:*

External links

https://github.com/apache/mina-sshd/issues/445
https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b
https://lists.apache.org/thread/m779jk702bg0h79gzbzq354k6kojjr39

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.