IBM Sterling B2B Integrator update for Apache MINA SSHD

1) Inadequate Encryption Strength

EUVDB-ID: #VU95799

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41909

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features and perform "Terrapin attack".

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Sterling B2B Integrator: 6.0.0.0 - 6.2.0.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_sterling_b2b_integrator:6.0.3.9:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_sterling_b2b_integrator:6.1.2.6:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_sterling_b2b_integrator:6.2.0.3:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7185262

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.