Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2008-5161 Details

Description

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:3.7 LOWVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://isc.sans.org/diary.html?storyid=5366	CVE
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705	CVE
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html	CVE
http://marc.info/?l=bugtraq&m=125017764422557&w=2	CVE
http://openssh.org/txt/cbc.adv	CVE
http://osvdb.org/49872	CVE
http://osvdb.org/50035	CVE
http://osvdb.org/50036	CVE
http://rhn.redhat.com/errata/RHSA-2009-1287.html	CVE
http://secunia.com/advisories/32740	CVE	Vendor Advisory
http://secunia.com/advisories/32760	CVE	Vendor Advisory
http://secunia.com/advisories/32833	CVE
http://secunia.com/advisories/33121	CVE
http://secunia.com/advisories/33308	CVE
http://secunia.com/advisories/34857	CVE
http://secunia.com/advisories/36558	CVE
https://exchange.xforce.ibmcloud.com/vulnerabilities/46620	CVE
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667	CVE
https://kc.mcafee.com/corporate/index?page=content&id=SB10106	CVE
https://kc.mcafee.com/corporate/index?page=content&id=SB10163	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279	CVE
http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1	CVE
http://support.apple.com/kb/HT3937	CVE
http://support.attachmate.com/techdocs/2398.html	CVE
http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm	CVE
http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt	CVE
http://www.kb.cert.org/vuls/id/958563	CVE	US Government Resource
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html	CVE
http://www.securityfocus.com/archive/1/498558/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/498579/100/0/threaded	CVE
http://www.securityfocus.com/bid/32319	CVE
http://www.securitytracker.com/id?1021235	CVE
http://www.securitytracker.com/id?1021236	CVE
http://www.securitytracker.com/id?1021382	CVE
http://www.ssh.com/company/news/article/953/	CVE	Vendor Advisory
http://www.vupen.com/english/advisories/2008/3172	CVE
http://www.vupen.com/english/advisories/2008/3173	CVE
http://www.vupen.com/english/advisories/2008/3409	CVE
http://www.vupen.com/english/advisories/2009/1135	CVE
http://www.vupen.com/english/advisories/2009/3184	CVE
http://isc.sans.org/diary.html?storyid=5366	[email protected]
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705	[email protected]
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html	[email protected]
http://marc.info/?l=bugtraq&m=125017764422557&w=2	[email protected]
http://openssh.org/txt/cbc.adv	[email protected]
http://osvdb.org/49872	[email protected]
http://osvdb.org/50035	[email protected]
http://osvdb.org/50036	[email protected]
http://rhn.redhat.com/errata/RHSA-2009-1287.html	[email protected]
http://secunia.com/advisories/32740	[email protected]	Vendor Advisory
http://secunia.com/advisories/32760	[email protected]	Vendor Advisory
http://secunia.com/advisories/32833	[email protected]
http://secunia.com/advisories/33121	[email protected]
http://secunia.com/advisories/33308	[email protected]
http://secunia.com/advisories/34857	[email protected]
http://secunia.com/advisories/36558	[email protected]
https://exchange.xforce.ibmcloud.com/vulnerabilities/46620	[email protected]
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667	[email protected]
https://kc.mcafee.com/corporate/index?page=content&id=SB10106	[email protected]
https://kc.mcafee.com/corporate/index?page=content&id=SB10163	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11279	[email protected]
http://sunsolve.sun.com/search/document.do?assetkey=1-66-247186-1	[email protected]
http://support.apple.com/kb/HT3937	[email protected]
http://support.attachmate.com/techdocs/2398.html	[email protected]
http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm	[email protected]
http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt	[email protected]
http://www.kb.cert.org/vuls/id/958563	[email protected]	US Government Resource
http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html	[email protected]
http://www.securityfocus.com/archive/1/498558/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/498579/100/0/threaded	[email protected]
http://www.securityfocus.com/bid/32319	[email protected]
http://www.securitytracker.com/id?1021235	[email protected]
http://www.securitytracker.com/id?1021236	[email protected]
http://www.securitytracker.com/id?1021382	[email protected]
http://www.ssh.com/company/news/article/953/	[email protected]	Vendor Advisory
http://www.vupen.com/english/advisories/2008/3172	[email protected]
http://www.vupen.com/english/advisories/2008/3173	[email protected]
http://www.vupen.com/english/advisories/2008/3409	[email protected]
http://www.vupen.com/english/advisories/2009/1135	[email protected]
http://www.vupen.com/english/advisories/2009/3184	[email protected]

see all 80 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]
CWE-329	Generation of Predictable IV with CBC Mode	CISA-ADP

Affected Products

Product	Versions
openbsd openssh	4.7p1
CPE cpe:2.3:a:openbsd:openssh:4.7p1:::::::* Remediation No remediation found in references.
ssh tectia client	4.0 4.0.1 4.0.3 4.0.4 4.0.5
CPE cpe:2.3:a:ssh:tectia_client:4.0:::::::* cpe:2.3:a:ssh:tectia_client:4.0.1:::::::* cpe:2.3:a:ssh:tectia_client:4.0.3:::::::* cpe:2.3:a:ssh:tectia_client:4.0.4:::::::* cpe:2.3:a:ssh:tectia_client:4.0.5:::::::* cpe:2.3:a:ssh:tectia_client:4.2:::::::* cpe:2.3:a:ssh:tectia_client:4.2.1:::::::* cpe:2.3:a:ssh:tectia_client:4.3:::::::* cpe:2.3:a:ssh:tectia_client:4.3.1:::::::* cpe:2.3:a:ssh:tectia_client:4.3.1j:::::::* cpe:2.3:a:ssh:tectia_client:4.3.2:::::::* cpe:2.3:a:ssh:tectia_client:4.3.2j:::::::* cpe:2.3:a:ssh:tectia_client:4.3.3:::::::* cpe:2.3:a:ssh:tectia_client:4.3.4:::::::* cpe:2.3:a:ssh:tectia_client:4.3.5:::::::* cpe:2.3:a:ssh:tectia_client:4.3.6:::::::* cpe:2.3:a:ssh:tectia_client:4.3.7:::::::* cpe:2.3:a:ssh:tectia_client:4.3.8k:::::::* cpe:2.3:a:ssh:tectia_client:4.3.9k:::::::* cpe:2.3:a:ssh:tectia_client:4.4:::::::* cpe:2.3:a:ssh:tectia_client:4.4.1:::::::* cpe:2.3:a:ssh:tectia_client:4.4.2:::::::* cpe:2.3:a:ssh:tectia_client:4.4.3:::::::* cpe:2.3:a:ssh:tectia_client:4.4.4:::::::* cpe:2.3:a:ssh:tectia_client:4.4.6:::::::* cpe:2.3:a:ssh:tectia_client:4.4.7:::::::* cpe:2.3:a:ssh:tectia_client:4.4.8:::::::* cpe:2.3:a:ssh:tectia_client:4.4.9:::::::* cpe:2.3:a:ssh:tectia_client:4.4.10:::::::* cpe:2.3:a:ssh:tectia_client:4.4.11:::::::* cpe:2.3:a:ssh:tectia_client:5.0.0:::::::* cpe:2.3:a:ssh:tectia_client:5.0.0f:::::::* cpe:2.3:a:ssh:tectia_client:5.0.1:::::::* cpe:2.3:a:ssh:tectia_client:5.0.1f:::::::* cpe:2.3:a:ssh:tectia_client:5.0.2:::::::* cpe:2.3:a:ssh:tectia_client:5.0.2f:::::::* cpe:2.3:a:ssh:tectia_client:5.0.3:::::::* cpe:2.3:a:ssh:tectia_client:5.0.3f:::::::* cpe:2.3:a:ssh:tectia_client:5.1.0:::::::* cpe:2.3:a:ssh:tectia_client:5.1.1:::::::* cpe:2.3:a:ssh:tectia_client:5.1.2:::::::* cpe:2.3:a:ssh:tectia_client:5.1.3:::::::* cpe:2.3:a:ssh:tectia_client:5.2.0:::::::* cpe:2.3:a:ssh:tectia_client:5.2.1:::::::* cpe:2.3:a:ssh:tectia_client:5.2.2:::::::* cpe:2.3:a:ssh:tectia_client:5.2.3:::::::* cpe:2.3:a:ssh:tectia_client:5.2.4:::::::* cpe:2.3:a:ssh:tectia_client:5.3.0:::::::* cpe:2.3:a:ssh:tectia_client:5.3.1:::::::* cpe:2.3:a:ssh:tectia_client:5.3.2:::::::* cpe:2.3:a:ssh:tectia_client:5.3.3:::::::* cpe:2.3:a:ssh:tectia_client:5.3.5:::::::* cpe:2.3:a:ssh:tectia_client:5.3.6:::::::* cpe:2.3:a:ssh:tectia_client:5.3.7:::::::* cpe:2.3:a:ssh:tectia_client:5.3.8:::::::* cpe:2.3:a:ssh:tectia_client:6.0.0:::::::* cpe:2.3:a:ssh:tectia_client:6.0.1:::::::* cpe:2.3:a:ssh:tectia_client:6.0.2:::::::* cpe:2.3:a:ssh:tectia_client:6.0.3:::::::* cpe:2.3:a:ssh:tectia_client:6.0.4:::::::* Remediation No remediation found in references.
ssh tectia connector	4.0.7 4.1.2 4.1.3 4.1.5 4.2.0
CPE cpe:2.3:a:ssh:tectia_connector:4.0.7:::::::* cpe:2.3:a:ssh:tectia_connector:4.1.2:::::::* cpe:2.3:a:ssh:tectia_connector:4.1.3:::::::* cpe:2.3:a:ssh:tectia_connector:4.1.5:::::::* cpe:2.3:a:ssh:tectia_connector:4.2.0:::::::* cpe:2.3:a:ssh:tectia_connector:4.3.0:::::::* cpe:2.3:a:ssh:tectia_connector:4.3.4:::::::* cpe:2.3:a:ssh:tectia_connector:4.3.5:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.0:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.2:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.4:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.6:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.7:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.9:::::::* cpe:2.3:a:ssh:tectia_connector:4.4.10:::::::* cpe:2.3:a:ssh:tectia_connector:5.0.0:::::::* cpe:2.3:a:ssh:tectia_connector:5.0.1:::::::* cpe:2.3:a:ssh:tectia_connector:5.0.2:::::::* cpe:2.3:a:ssh:tectia_connector:5.0.3:::::::* cpe:2.3:a:ssh:tectia_connector:5.1.0:::::::* cpe:2.3:a:ssh:tectia_connector:5.1.1:::::::* cpe:2.3:a:ssh:tectia_connector:5.1.2:::::::* cpe:2.3:a:ssh:tectia_connector:5.1.3:::::::* cpe:2.3:a:ssh:tectia_connector:5.2.2:::::::* cpe:2.3:a:ssh:tectia_connector:5.3.0:::::::* cpe:2.3:a:ssh:tectia_connector:5.3.1:::::::* cpe:2.3:a:ssh:tectia_connector:5.3.2:::::::* cpe:2.3:a:ssh:tectia_connector:5.3.3:::::::* cpe:2.3:a:ssh:tectia_connector:5.3.7:::::::* cpe:2.3:a:ssh:tectia_connector:5.3.8:::::::* Remediation No remediation found in references.
ssh tectia connectsecure	6.0.0 6.0.1 6.0.2 6.0.3 6.0.4
CPE cpe:2.3:a:ssh:tectia_connectsecure:6.0.0:::::::* cpe:2.3:a:ssh:tectia_connectsecure:6.0.1:::::::* cpe:2.3:a:ssh:tectia_connectsecure:6.0.2:::::::* cpe:2.3:a:ssh:tectia_connectsecure:6.0.3:::::::* cpe:2.3:a:ssh:tectia_connectsecure:6.0.4:::::::* Remediation No remediation found in references.
ssh tectia server	4.0 4.0.3 4.0.4 4.0.5 4.0.7
CPE cpe:2.3:a:ssh:tectia_server:4.0:::::::* cpe:2.3:a:ssh:tectia_server:4.0.3:::::::* cpe:2.3:a:ssh:tectia_server:4.0.4:::::::* cpe:2.3:a:ssh:tectia_server:4.0.5:::::::* cpe:2.3:a:ssh:tectia_server:4.0.7:::::::* cpe:2.3:a:ssh:tectia_server:4.1.2:::::::* cpe:2.3:a:ssh:tectia_server:4.1.3:::::::* cpe:2.3:a:ssh:tectia_server:4.1.5:::::::* cpe:2.3:a:ssh:tectia_server:4.2.0:::::::* cpe:2.3:a:ssh:tectia_server:4.2.1:::::::* cpe:2.3:a:ssh:tectia_server:4.2.2:::::::* cpe:2.3:a:ssh:tectia_server:4.3:::::::* cpe:2.3:a:ssh:tectia_server:4.3.0:::::::* cpe:2.3:a:ssh:tectia_server:4.3.1:::::::* cpe:2.3:a:ssh:tectia_server:4.3.2:::::::* cpe:2.3:a:ssh:tectia_server:4.3.3:::::::* cpe:2.3:a:ssh:tectia_server:4.3.4:::::::* cpe:2.3:a:ssh:tectia_server:4.3.5:::::::* cpe:2.3:a:ssh:tectia_server:4.3.6:::::::* cpe:2.3:a:ssh:tectia_server:4.3.7:::::::* cpe:2.3:a:ssh:tectia_server:4.4:::::::* cpe:2.3:a:ssh:tectia_server:4.4.0:::::::* cpe:2.3:a:ssh:tectia_server:4.4.1:::::::* cpe:2.3:a:ssh:tectia_server:4.4.2:::::::* cpe:2.3:a:ssh:tectia_server:4.4.4:::::::* cpe:2.3:a:ssh:tectia_server:4.4.5:::::::* cpe:2.3:a:ssh:tectia_server:4.4.6:::::::* cpe:2.3:a:ssh:tectia_server:4.4.7:::::::* cpe:2.3:a:ssh:tectia_server:4.4.8:::::::* cpe:2.3:a:ssh:tectia_server:4.4.9:::::::* cpe:2.3:a:ssh:tectia_server:4.4.10:::::::* cpe:2.3:a:ssh:tectia_server:4.4.11:::::::* cpe:2.3:a:ssh:tectia_server:5.0.0:::::::* cpe:2.3:a:ssh:tectia_server:5.0.1:::::::* cpe:2.3:a:ssh:tectia_server:5.0.2:::::::* cpe:2.3:a:ssh:tectia_server:5.0.3:::::::* cpe:2.3:a:ssh:tectia_server:5.1.0:::::::* cpe:2.3:a:ssh:tectia_server:5.1.1:::::::* cpe:2.3:a:ssh:tectia_server:5.1.1::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.1.2:::::::* cpe:2.3:a:ssh:tectia_server:5.1.3:::::::* cpe:2.3:a:ssh:tectia_server:5.2.0:::::::* cpe:2.3:a:ssh:tectia_server:5.2.0::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.2.1::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.2.2:::::::* cpe:2.3:a:ssh:tectia_server:5.2.2::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.2.3:::::::* cpe:2.3:a:ssh:tectia_server:5.2.4:::::::* cpe:2.3:a:ssh:tectia_server:5.3.0:::::::* cpe:2.3:a:ssh:tectia_server:5.3.0::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.3.1:::::::* cpe:2.3:a:ssh:tectia_server:5.3.2:::::::* cpe:2.3:a:ssh:tectia_server:5.3.3:::::::* cpe:2.3:a:ssh:tectia_server:5.3.4:::::::* cpe:2.3:a:ssh:tectia_server:5.3.5:::::::* cpe:2.3:a:ssh:tectia_server:5.3.6:::::::* cpe:2.3:a:ssh:tectia_server:5.3.7:::::::* cpe:2.3:a:ssh:tectia_server:5.3.8:::::::* cpe:2.3:a:ssh:tectia_server:5.4.0::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.4.1::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.4.2::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.5.0::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:5.5.1::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:6.0.0:::::::* cpe:2.3:a:ssh:tectia_server:6.0.0::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:6.0.1:::::::* cpe:2.3:a:ssh:tectia_server:6.0.1::ibm_zos::::: cpe:2.3:a:ssh:tectia_server:6.0.2:::::::* cpe:2.3:a:ssh:tectia_server:6.0.3:::::::* cpe:2.3:a:ssh:tectia_server:6.0.4:::::::* cpe:2.3:a:ssh:tectia_server:6.0.4::linux_ibm_zos::::: Remediation No remediation found in references.

Change History

14 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Jun 16, 2026	CVE Modified	CISA-ADP
May 28, 2026	CVE Modified	CISA-ADP
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 11, 2018	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Aug 8, 2017	CVE Modified	[email protected]
Jan 3, 2017	CVE Modified	[email protected]
Dec 8, 2016	CVE Modified	[email protected]
Nov 28, 2016	CVE Modified	[email protected]
Jun 11, 2016	CVE Modified	[email protected]
Aug 8, 2014	Initial Analysis	[email protected]

CVE-2008-5161 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO