A Bug That Can Leak Private Cryptographic Keys Has Been Fixed In OpenSSH

A Bug That Can Leak Private Cryptographic Keys Has Been Fixed In OpenSSH

OpenSSH is the widely used implementations of the SSH(Secure Shell) protocol and a bug was there which possess the ability to leak secret cryptographic keys, But now that has been fixed in Open SSH.

Actually, the Qualys Security Team was the first who discovered and announced the vulnerability affects in OpenSSH versions 5.4 through 7.1. This vulnerability does not reside in the server versions it reside in the version end users which is used to connect to the servers and once this vulnerability takes place the bug can easily contain the contents of the computer like the private encryption key for SSH connections.

On Thursday OpenSSH officials wrote that

"The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers."

According to the advisory “Whatever High-profile sites and users have already been exploited by the sophisticated attackers through this bug need to regenerate their SSH keys”

Into a vulnerable computer, this bug can give the attackers the ability to read the RAM contents and as it only exploits after the vulnerable system connected to the malicious server, so it’s considered less severe. This bug has similarities to the 2014 Heartbleed vulnerability (used to implement the Transport Layer Security (TLS) protocol) that affected the OpenSSL crypto library. Ubuntu Linux versions like- 12.04, 1404, 15.04, and 15.10 contain this bug along with some versions of the Red Hat Enterprise Linux too.

Remediation Tips:

There are several steps by which you can remediate the affect of this vulnerability:

-    Download and apply the security patch.

-    Add the "UseRoaming No" to /etc/ssh/ssh_config (or the user's ~/.ssh/config) file:

 # echo -e 'Host *\nUseRoaming no' >> /etc/ssh/ssh_config

We have advice for the developers and admins including Github try to regenerate and rotate the keys of the system.