#VU95799 Inadequate Encryption Strength in Apache Mina SSHD - CVE-2024-41909

Vulnerability identifier: #VU95799

Vulnerability risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41909

CWE-ID: CWE-326

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache Mina SSHD
Server applications / Remote management servers, RDP, SSH

Vendor: Apache Foundation

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features and perform "Terrapin attack".

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apache Mina SSHD: 2.0.0 - 2.11.0

---

External links
https://github.com/apache/mina-sshd/issues/445
https://lists.apache.org/thread/vwf1ot8wx1njyy8n19j5j2tcnjnozt3b
https://lists.apache.org/thread/m779jk702bg0h79gzbzq354k6kojjr39

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.