cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1289
Views
0
Helpful
6
Replies

XML Gateway Software - OpenSSH

b-cunningham
Level 1
Level 1

Hello.

I’m trying to remediate a vulnerability scan that was run against our ACE XML Gateway running version 6.1. The scan came back with three possible vulnerabilities all referring to various versions of OpenSSH. How do I confirm what OpenSSH version my XML Gateway is using?

ACE XML Gateway 6.1-2009-10-20T15

6.1-1138

kernel: 2.4.21-47.ELsmp

Cavium: 1.0-1

Scan showed:

OpenSSH Multiple Memory Management Vulnerabilities fixed in OpenSSH v3.7.1

OpenSSH GSSAPI Credential Disclosure Vulnerability fixed in OpenSSH v4.2

OpenSSH Signal Handling Vulnerability fixed in OpenSSH v4.4

1 Accepted Solution

Accepted Solutions

Sean Merrow
Level 4
Level 4

Hello,

Sorry, I did not see your post here.  I only first saw the one in the Ask-the-Expert thread.  Now I see why you posted in the Ask-the-Expert....just trying to get an answer!  ;- )

Sean

View solution in original post

6 Replies 6

Sean Merrow
Level 4
Level 4

Hello,

Sorry, I did not see your post here.  I only first saw the one in the Ask-the-Expert thread.  Now I see why you posted in the Ask-the-Expert....just trying to get an answer!  ;- )

Sean

Thank you Sean.

Brad

Brad Cunningham

Senior Network Technician

Alaska USA Federal Credit Union

PO Box 196613

Anchorage, AK 99519-6613

b.cunningham@alaskausa.org

Phone: 907-786-2937 Fax 907-929-6826

Sorry I missed the hint about being in the wrong forum.

I have been unable to find any documentation on Cisco’s site regarding any patching on OpenSSH. Can anyone point me in the right direction so I can have something to say on my remediation?

b-cunningham
Level 1
Level 1

.....or if no documentation exists, is this expected to be fixed in a later release?

Hi Brad,

The developement team has been adding security patches to the 3.6 OpenSSH for some time now.  They have told us that the AXG is not vulnerable to any of the security issues that 3.6 had.  Unfortunately, the only documentation we have is what you see on CCO.  If you require further information, then you'll need to open up a case with Cisco TAC so they can engage the necessary folks in engineering that can address your specific questions.

I wish I could be of more help on this in this forum.

Thanks,


Sean

Thank you very much for your time.

Brad

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: