Symptom
This product may include a version of OpenSSH that is affected by the vulnerability identified by one or more of the following Common Vulnerability and Exposures (CVE) IDs:
CVE-2015-5600: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5600
CVE-2015-6563: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6563
CVE-2015-6564: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6564
Conditions
-- Device enabled with SSH client support.
-- OpenSSH version prior to 6.9 (16.12.X releases)
Workaround
Upgrade to 17.3.3 release as it uses OpenSSH version 7.8 p1
Further Problem Description
None
PSIRT Evaluation
The Cisco PSIRT has assigned this bug the following CVSS version 3.1 score. The Base CVSS score as of the time of evaluation is 5.3:
https://tools.cisco.com/security/center/cvssCalculator.x?vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE ID CVE-2015-5600, CVE-2015-6563 and CVE-2015-6564 have been assigned to these issues.
Information about Fixed, Vulnerable, and Nonvulnerable releases--as well as information about fixed release availability--is not maintained by Cisco PSIRT. Please refer to the appropriate fields in this bug. If you require additional help to obtain this information, please open a support case with your support organization.
Additional information on Cisco's security vulnerability policy can be found at the following URL:
https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html
