topic Re: XML Gateway Software - OpenSSH in Application Networking

XML Gateway Software - OpenSSH

b-cunningham — Tue, 15 Jun 2010 21:37:30 GMT

Hello.

I’m trying to remediate a vulnerability scan that was run against our ACE XML Gateway running version 6.1. The scan came back with three possible vulnerabilities all referring to various versions of OpenSSH. How do I confirm what OpenSSH version my XML Gateway is using?

ACE XML Gateway 6.1-2009-10-20T15

6.1-1138

kernel: 2.4.21-47.ELsmp

Cavium: 1.0-1

Scan showed:

OpenSSH Multiple Memory Management Vulnerabilities fixed in OpenSSH v3.7.1

OpenSSH GSSAPI Credential Disclosure Vulnerability fixed in OpenSSH v4.2

OpenSSH Signal Handling Vulnerability fixed in OpenSSH v4.4

Re: XML Gateway Software - OpenSSH

Sean Merrow — Thu, 17 Jun 2010 12:44:29 GMT

Hello,

Sorry, I did not see your post here. I only first saw the one in the Ask-the-Expert thread. Now I see why you posted in the Ask-the-Expert....just trying to get an answer! ;- )

Sean

Re: XML Gateway Software - OpenSSH

b-cunningham — Thu, 17 Jun 2010 15:13:14 GMT

Thank you Sean.

Brad

Brad Cunningham

Senior Network Technician

Alaska USA Federal Credit Union

PO Box 196613

Anchorage, AK 99519-6613

b.cunningham@alaskausa.org

Phone: 907-786-2937 Fax 907-929-6826

Re: XML Gateway Software - OpenSSH

b-cunningham — Thu, 17 Jun 2010 21:31:47 GMT

Sorry I missed the hint about being in the wrong forum.

I have been unable to find any documentation on Cisco’s site regarding any patching on OpenSSH. Can anyone point me in the right direction so I can have something to say on my remediation?

Re: XML Gateway Software - OpenSSH

b-cunningham — Thu, 17 Jun 2010 21:39:08 GMT

.....or if no documentation exists, is this expected to be fixed in a later release?

Re: XML Gateway Software - OpenSSH

Sean Merrow — Fri, 18 Jun 2010 12:28:13 GMT

Hi Brad,

The developement team has been adding security patches to the 3.6 OpenSSH for some time now. They have told us that the AXG is not vulnerable to any of the security issues that 3.6 had. Unfortunately, the only documentation we have is what you see on CCO. If you require further information, then you'll need to open up a case with Cisco TAC so they can engage the necessary folks in engineering that can address your specific questions.

I wish I could be of more help on this in this forum.

Thanks,

Sean

Re: XML Gateway Software - OpenSSH

b-cunningham — Fri, 18 Jun 2010 15:03:09 GMT

Thank you very much for your time.

Brad