topic Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion) in Network Access Control

Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

adamscottmaster2013 — Wed, 10 Jul 2024 11:23:53 GMT

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024?emailclick=CNSemail

Identity Services Engine (ISE)

CSCwk61938

3.3 patch (Jul 2024)
3.2 patch (Sep 2024)
3.1 patch (Jan 2025)

None of the patches listed above is available.

According to this article, ISE 3.2 patch-x is vulnerable; however, in the same article, it references a bug ID https://tools.cisco.com/bugsearch/bug/CSCwk61938 and stated that the issue is fixed.

Thoughts?

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

adamscottmaster2013 — Wed, 10 Jul 2024 11:25:57 GMT

Looks like Cisco is updating the bugID since I read it yesterday:

Workaround: Cisco is working on a hotpatch for 3.1 and 3.2. Permanent fix is planned for 3.1 patch 10 and 3.2 patch 7 Fix for 3.3 is available in patch 3 - ETA July 16th

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

Saravana17 — Thu, 11 Jul 2024 11:04:59 GMT

Hello,
In this bug ID, details needs to be clear like what about 3.1 Patch 5, 6, 7, 8,9 which is vulnerable or not?
Because, we got an alert from our internal SOC team that few of the servers running with 3.1 patch 8 is affected and few are not affected which is very confusing.

I tried to check the openssh version on the Cisco ISE nodes but there is no details how to verify this 😞

Does anyone knows how to verify if the machine is affected or not by this vulnerability?

https://tools.cisco.com/bugsearch/bug/CSCwk61938

Thanks,
Saravana

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

DCampus — Thu, 18 Jul 2024 06:00:12 GMT

it is now July 18. and a fix/update has not been released yet

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

cnorborg — Mon, 22 Jul 2024 21:06:01 GMT

Unfortunately the "Fix" to ISE3.3, with Patch 3 that is now out, is NOT a fix. The OpenSSH version that fixes the issue is 9.8. Going from Patch2 to Patch3 brought me from OpenSSH v8.8 to OpenSSH v9.1, NOT the 9.8 required to fix it? They say this is a "workaround", but I see nothing in the CVE that mentions 9.1 being an acceptable workaround?

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

Saravana17 — Thu, 01 Aug 2024 07:00:51 GMT

Hi @cnorborg ,
Yes, you are right. the hotpatch upgraded Openssh version to 9.1 but not to the remediated version as 9.8 or later. Yesterday I tested with 3.1 hotpatch as well but it's same.
Not sure if any revised hotpatch will be released?

Thanks,
Saravana

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

SamCruz92287 — Wed, 07 Aug 2024 15:52:13 GMT

Hi anyone updated their ise to 3.4.0? It says in the release notes that the CSCwk61938 is resolved. See release notes: https://www.cisco.com/c/en/us/td/docs/security/ise/3-4/release_notes/b_ise_34_RN.html

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

Saravana17 — Mon, 12 Aug 2024 06:30:29 GMT

Hi All,
It's good to know that now Cisco updated that clearly this vulnerability is fixed on the released hotpatches (Openssh V9.1).
Below is updated on the bug details,
NOTE: Cisco uses a customized library for SSH, the fix for this vulnerability is implemented in CiscoSSH 1.13.48 (based on OpenSSH 9.1)

Thanks,
Saravana

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

cnorborg — Mon, 12 Aug 2024 14:17:36 GMT

Below? Did you forget to post a link or something?

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

Saravana17 — Mon, 12 Aug 2024 14:37:02 GMT

No, It's mentioned on the same Cisco bug ID link,

https://tools.cisco.com/bugsearch/bug/CSCwk61938

Thanks,
Saravana

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

Chris_Schubert — Thu, 22 Aug 2024 16:00:01 GMT

I have done this as well. ISE 3.3 patch 3 is NOT reporting as compliant and it is NOT fixing this vulnerability.

Re: Cisco: CVE-2024-6387 OpenSSH Server (regreSSHion)

Saravana17 — Sun, 25 Aug 2024 20:46:45 GMT

Hi,
How did you verify that if this is not compliant?

As per cisco below update,

NOTE: Cisco uses a customized library for SSH, the fix for this vulnerability is implemented in CiscoSSH 1.13.48 (based on OpenSSH 9.1)

https://tools.cisco.com/bugsearch/bug/CSCwk61938

Thanks,
Saravana