SSH Server CBC Mode Ciphers Enabled on Huawei Switches & Routers

Nessus / Qualys scan

Description

The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.

Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.

Output

• The following client-to-server Cipher Block Chaining (CBC) algorithms
  are supported : 
  
    3des-cbc
    aes128-cbc
    aes256-cbc
  
  The following server-to-client Cipher Block Chaining (CBC) algorithms
  are supported : 
  
    3des-cbc
    aes128-cbc
    aes256-cbc
  

Solution

This solution is for Huwaei Network equipment 

You need to stop the switches and other eqipments from using the CBC algorithm. So Configure CTR algorithm which is more secure to be used with SSH.

Configure CTR encryption algorithms for an SSH server.

<HUAWEI> system-view
[~HUAWEI] ssh server cipher aes256_ctr aes128_ctr