Description: Secure Shell (SSH) is a network protocol that creates a secure channel between two network devices to allow data exchange. SSH can create this secure channel by using the Cipher Block Chaining (CBC). An attacker may be able to recover up to 32 bits of plain text from arbitrary block of encrypted text.

CVE: N/A
Risk Factor: Low
CVSS Base Score: 2,6

Solution: Below is the procedure to correct the evidenced vulnerability.

LINUX OPERATING SYSTEM:

Keep in mind that configuration commands and routes vary for each Linux distribution, but the procedure applies for any caseo.

  1. Proceed to edit file ssh_config located in the path /etc/ssh/sshd_config with the vim text editor, you can use other editors such as vi or nano.
  2. Into the ssh_config file locate the piece of text that shows below:
  3. To delete the comments only takes to delete the # and also delete all entries of this cipher modes:aes128-cbc, 3des-cbc, MACs hmac-md5, the lines must look like this::
  4. Save changes and exit the file.
  5. Restart the service: sudo systemctl restart ssh.service

 

WINDOWS OPERATING SYSTEMS:

  1. Start the registry editor (Regedt32.exe) and then search the next key: HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL
  2. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \ RC4 128/128
    Change the DWORD data values from Enabled (1) to Disabled(0). This registry key doesn’t apply to a exportable server that doesn’t have a SGC certificate.
  3. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \ Triple DES 168
    Change the DWORD data values from Enabled (1) to Disabled(0). This  registry key doesn’t apply to the exportation version.
  4. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \RC2 128/128
    Change the DWORD data values from Enabled (1) to Disabled(0). This registry key doesn’t apply to the exportation version.
  5. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \RC4 64/128
    Change the DWORD data values from Enabled (1) to Disabled(0). This registry key doesn’t apply to the exportation version.(but is used by Microsoft Money).
  6. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \RC4 56/128
    Change the DWORD data values from Enabled (1) to Disabled(0).
    Disabling this algorithm doesn’t allow the next:TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
  7. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \DES 56
    It’s implementation on the next files Rsabase.dll y Rsaenh.dll it’s validated under the cryptographic module validation program FIPS 140-1. Change the DWORD data values from Enabled (1) to Disabled(0).
  8. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \RC4 40/128
    Change the DWORD data values from Enabled (1) to Disabled(0).Disabling this algorithm doesn’t allow the next:SSL_RSA_EXPORT_WITH_RC4_40_MD5
    TLS_RSA_EXPORT_WITH_RC4_40_MD5
  9. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \RC2 40/128
    Change the DWORD data values from Enabled (1) to Disabled(0).
    Disabling this algorithm doesn’t allow the next:SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
    TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  10. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \MD5
    Change the DWORD data values from Enabled (1) to Disabled(0).Disabling this algorithm doesn’t allow the next:
    SSL_RSA_EXPORT_WITH_RC4_40_MD5
    SSL_RSA_WITH_RC4_128_MD5
    SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
    TLS_RSA_EXPORT_WITH_RC4_40_MD5
    TLS_RSA_WITH_RC4_128_MD5
    TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  11. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \SHA
    Change the DWORD data values from Enabled (1) to Disabled(0).Disabling this algorithm doesn’t allow the next:
    SSL_RSA_WITH_RC4_128_SHA
    SSL_RSA_WITH_DES_CBC_SHA
    SSL_RSA_WITH_3DES_EDE_CBC_SHA
    SSL_RSA_EXPORT1024_WITH_DES_CBC_SHA
    SSL_RSA_EXPORT1024_WITH_RC4_56_SHA
    TLS_RSA_WITH_RC4_128_SHA
    TLS_RSA_WITH_DES_CBC_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA
    TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
    TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
  12. Search this key:
    HKLM \ SYSTEM \ CurrentControlSet \ Control \ SecurityProviders \ SCHANNEL \ Ciphers \KeyExchangeAlgorithms \ PKCS
    Change the DWORD data values from Enabled (1) to Disabled(0).

 

If you have any doubt to mitigate this vulnerability on Windows OS, follow the next link:

https://support.microsoft.com/en-us/help/245030/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protoc