vulnerability-SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)

[Hitendra]

in recent scanning, we received "SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)" vulnerability on port 22.

just use this command in nmap "nmap -sV -p 22 --script ssh2-enum-algos 192.168.xxx.xxx"

if it shows "chacha20-poly1305@openssh.com" or any this with "-etm" then it will enables the Terrapin Attack.

will it get patch or need to do anything manually.

 

[AEK]

FortiOS is not impacted by this vulnerability.

For other equipment update as mentioned in the below doc.

https://www.fortiguard.com/psirt/FG-IR-23-490

Now if you mean you discovered the vulnerability on a device other than Fortinet then you make sure your FG's IPS signatures up to date.

https://www.fortiguard.com/encyclopedia/ips/54577

And ideally update/patch your affected ssh server.

[Hitendra]

@AEK as you mention - FortiOS is not impacted by this vulnerability.

also in link you shared shows 

Products confirmed NOT impacted:

FortiOS

--------------------

but i have FortiGate100E firewall with Firmware Version v7.0.14 build0601 (Mature). as the screenshot shared has the algorithms that are mentioned in "SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)" vulnerability.

[AEK]

I searched a bit about this vulnerability and it seems that the ChaCha20-Poly1305 algorithme was not removed in the related OpenSSH fix but just hardened instead. That explains why the mentioned algorithm is still there in your FG.

[smaruvala]

Hi,

We have confirmed no impact on FortiGate/FortiOS for CVE-2023-48795. Even if scanners flag the device as vulnerable when using the affected ciphers, the vulnerability is not exploitable on FOS. The vulnerability has been fixed in FOS v7.4.4 and 7.2.8, which can be considered as a precaution fix since no version is impacted by this vulnerability.

Regards,

Shiva

[Hitendra]

@smaruvala you mean to say if scanners flag the device as vulnerable due to available of affected ciphers which should not be shown. but still, if we upgrade firmware to 7.2.8 (as shown in below upgrade path) it will fix the vulnerable ciphers and will not show in the scanner.

 

[AEK]

I don't understand it like that, but probably 7.2.8 has simply dropped this algorithm.

[smaruvala]

Hi @Hitendra ,

Even though the algorithm is shown in nmap it is not exploitable in Fortigate/FortiOS. Hence it was considered as not vulnerable. However upgrading to fixed version is good idea as it is a preventive step.

Regards,

Shiva