topic Re: OpenSSH upgrade R81.10 in General Topics

OpenSSH upgrade R81.10

Ross_Wood — Tue, 17 Jan 2023 01:36:31 GMT

Hi,

We have just had a pen test done on our Checkpoint management server which is running R810.10 take 79 and it has stated we have OpenSSH version 7.8 installed and this needs to be upgraded to version 9.1. From the pen test is says the system is running OpenSSH version 7.8p1 which has known flaw that allows Man-in-the-Middle attacks. A successful attack can expose privileged encrypted data.

Does anyone know if OpenSSH can be upgraded on this version of R81.10?

Thanks.

Re: OpenSSH upgrade R81.10

_Val_ — Tue, 17 Jan 2023 07:43:55 GMT

Please review sk100647 & sk65269. I do not think the results of your penetration tests are valid.

Re: OpenSSH upgrade R81.10

PhoneBoy — Tue, 17 Jan 2023 20:41:56 GMT

It is not possible to update the OpenSSH version independently of the version of the Security Gateway.
In R81.20, we also distribute OpenSSH_7.8p1.
Having said that, we also evaluate the various CVEs filed against OpenSSH and patch our versions accordingly, if necessary.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk65269

Re: OpenSSH upgrade R81.10

Chris_Atkinson — Wed, 18 Jan 2023 00:00:37 GMT

The alphanumeric version code isn't sufficient to determine exposure.

Some related previous discussion is available here:

https://community.checkpoint.com/t5/Security-Gateways/ssh-version-hide-while-telnet-to-gateway-port-22/m-p/159513