How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails Trustwave's vulnerability scans. I tried to dispute by showing a lock down of all outbound connections to unknown sources on port 22, but this was not considered sufficient mitigation.

  • Well, the SSH protocol or the SSH client is not affected so I guess scp client is not considered that much a priority. – Overmind Mar 22 '19 at 12:51
  • Yeah, only is for me because it'll fail PCI. – flickerfly Mar 22 '19 at 16:44
  • @flickerfly have you considered using a Jumphost? I put all our servers and customers servers behind a Jumphost, this allows you to maintain a single point of entry and you can have the latest software and patches for openssh etc, and only have the Jumphost be able to communicate on the ssh port with the centos6 server. – kingmilo Mar 26 '19 at 4:19
  • @kingmilo, this is a scan against a jumphost. These CVEs aren't patched on CentOS 6 SSH or in the available OpenSSH tarballs. Only option appears to be the Sintonen patch. – flickerfly Mar 26 '19 at 15:44
  • @flickerfly ahh ok, I got you. Yup I had a similar issue on Centos 6. Are you looking to secure the SSH ports only? If so I can share my dynamic ports setup, if you don’t have too many clients connecting then it might be the solution for you. Let me know. – kingmilo Mar 26 '19 at 16:33

We found https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt which has a few patches in the mitigation section. I used these against a fresh download of openssh-7.9p1. I had to do a minor edit to scp.c around hunk #9 for the patch as it looked like a partial hunk of this patch was already in place. I also had to ignore whitespace.

wget https://ftp3.usa.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.9p1.tar.gz
wget https://sintonen.fi/advisories/scp-name-validator.patch
tar zxvf openssh-7.9p1.tar.gz
cd openssh-7.9p1
vim scp.c
patch -p1 --ignore-whitespace < scp-name-validator.patch

My change to scp.c removed line 1108 and replaced it with this. You can see why in the patch file at line 271. The Patch will replace this with the desired line.

if (*cp == '\0' || strchr(cp, '/') != NULL ||
  strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {

Then ./configure --with-pam, make, make install or whatever you would usually do to upgrade you OpenSSH running version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.