Joerg Schwenk

O problema está relacionado à verificação insuficiente dos dados de autenticação na implementação do protocolo SSH no PuTTY. Isso pode permitir que um invasor remoto obtenha acesso não autorizado a informações protegidas. Especificamente, o PuTTY prossegue com o estabelecimento de uma sessão SSH mesmo que nunca tenha recebido uma resposta de autenticação válida, facilitando que um servidor SSH controlado pelo invasor apresente posteriormente um prompt de autenticação falsificado. Isso pode ser usado para capturar dados de credenciais para fins indesejados pelo usuário cliente.

The Internet Key Exchange v1 main mode is susceptible to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is known that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This issue could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network.

Name of the Vulnerable Software and Affected Versions: Huawei Firewall products USG2205BSR version V300R001C10SPC600 Huawei Firewall products USG2220BSR version V300R001C00 Huawei Firewall products USG5120BSR version V300R001C00 Huawei Firewall products USG5150BSR version V300R001C00 Description: The issue is related to a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher RSA padding oracle, causing a Bleichenbacher oracle attack. Successful exploitation of this issue can impact IPSec tunnel security. Recommendations: For USG2205BSR version V300R001C10SPC600, consider disabling the IPSEC IKEv1 implementation until a patch is available. For USG2220BSR version V300R001C00, consider disabling the IPSEC IKEv1 implementation until a patch is available. For USG5120BSR version V300R001C00, consider disabling the IPSEC IKEv1 implementation until a patch is available. For USG5150BSR version V300R001C00, consider disabling the IPSEC IKEv1 implementation until a patch is available.

Name of the Vulnerable Software and Affected Versions: Huawei Firewall products USG2205BSR version V300R001C10SPC600 Huawei Firewall products USG2220BSR version V300R001C00 Huawei Firewall products USG5120BSR version V300R001C00 Huawei Firewall products USG5150BSR version V300R001C00 Description: The issue is related to the IPSEC IKEv1 implementations of Huawei Firewall products, where improper handling of malformed messages can be exploited. An attacker may send crafted packets to the affected device, potentially leading to a denial of service. Recommendations: For USG2205BSR version V300R001C10SPC600, update the software to a version that properly handles malformed messages in IPSEC IKEv1 implementations. For USG2220BSR version V300R001C00, update the software to a version that properly handles malformed messages in IPSEC IKEv1 implementations. For USG5120BSR version V300R001C00, update the software to a version that properly handles malformed messages in IPSEC IKEv1 implementations. For USG5150BSR version V300R001C00, update the software to a version that properly handles malformed messages in IPSEC IKEv1 implementations.

Name of the Vulnerable Software and Affected Versions: Huawei Firewall products USG2205BSR version V300R001C10SPC600 Huawei Firewall products USG2220BSR version V300R001C00 Huawei Firewall products USG5120BSR version V300R001C00 Huawei Firewall products USG5150BSR version V300R001C00 Description: The issue is related to a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. This vulnerability is caused by improper handling of malformed messages. An attacker can exploit this by sending crafted packets to the affected device, potentially leading to a denial of service. Recommendations: For USG2205BSR version V300R001C10SPC600, update the IPSEC IKEv1 implementation to properly handle malformed messages. For USG2220BSR version V300R001C00, update the IPSEC IKEv1 implementation to properly handle malformed messages. For USG5120BSR version V300R001C00, update the IPSEC IKEv1 implementation to properly handle malformed messages. For USG5150BSR version V300R001C00, update the IPSEC IKEv1 implementation to properly handle malformed messages. As a temporary workaround, consider restricting access to the IPSEC IKEv1 implementation until a patch is available.

The issue allows remote attackers to cause a denial of service, consuming CPU and memory, via crafted XML with a large number of elements, attributes, nested constructs, and possibly other vectors.

The issue allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."