Description
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:5.1p1-5 | — |
| Debian 13 | openssh | 1:5.1p1-5 | — |
| Debian 12 | openssh | 1:5.1p1-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openssh +3 | 4.3p2-36.el5 | RHSA-2009:1287 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
SSH Version Scanner
auxiliary/scanner/ssh/ssh_version
GitHub 1 repository
-
talha3117/OpenSSH-4.7p1-CVE-2008-5161-Exploit ★ 0 · Oct 8, 2025
CVE-2008-5161 OpenSSH 4.7p1 Audit Helper Automates version checking and credential auditing of legacy OpenSSH 4.7p1 (Debian-8ubuntu1) targets by driving Metasploit’s auxiliary/scanner/ssh/ssh_login m…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2009:1287 Red Hat Security Advisory: openssh security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://openssh.org/txt/cbc.adv
- 247186 vendor-advisory
- 32319 vdb-entry
- 33121 third-party-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667
- 49872 vdb-entry
- 33308 third-party-advisory
- RHSA-2009:1287 vendor-advisory
- http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
- 1021382 vdb-entry
- https://kc.mcafee.com/corporate/index?page=content&id=SB10163
- 50036 vdb-entry
- 32833 third-party-advisory
- 36558 third-party-advisory
- 50035 vdb-entry
- http://www.ssh.com/company/news/article/953/
- 1021235 vdb-entry
- 34857 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-503.htm
- http://support.attachmate.com/techdocs/2398.html
- http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CPNI957037.html
- ADV-2008-3173 vdb-entry
- 20081123 Revised: OpenSSH security advisory: cbc.adv mailing-list
- openssh-sshtectia-cbc-info-disclosure(46620) vdb-entry
- 32740 third-party-advisory
- ADV-2009-1135 vdb-entry
- 32760 third-party-advisory
- ADV-2009-3184 vdb-entry
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 1021236 vdb-entry
- https://kc.mcafee.com/corporate/index?page=content&id=SB10106
- HPSBMA02447 vendor-advisory
- http://isc.sans.org/diary.html?storyid=5366
- APPLE-SA-2009-11-09-1 vendor-advisory
- ADV-2008-3409 vdb-entry
- ADV-2008-3172 vdb-entry
- oval:org.mitre.oval:def:11279 vdb-entry signature
- 20081121 OpenSSH security advisory: cbc.adv mailing-list
- http://support.apple.com/kb/HT3937
- VU#958563 third-party-advisory