# OpenSSH faces two new security holes, potentially high risk causing information security ## **Overview** Security researchers have just discovered a **serious vulnerability in OpenSSH** that can be exploited to carry out **Man-in-the-Middle (MitM) and Denial of Service (DoS) attacks**. This is a major issue because OpenSSH is one of the most **widely used secure communication tools on the internet**, commonly used in Linux, macOS, and some Windows systems. According to **Qualys TRU (Threat Research Unit)** - a **Threat Research Unit of Qualys**, two vulnerabilities related to this attack campaign have been identified: * **CVE-2025-26465:** This vulnerability allows attackers to perform **Man-in-the-Middle (MitM) attacks** by impersonating a legitimate server. * **CVE-2025-26466:** This vulnerability allows for **Denial of Service (DoS) attacks before authentication**. ![OpenSSH](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhE70jiODdSyQ2yUz6vu1Nxs_xJ9WUOpw1IqiOiUH0-dgosq8JJbjCS3JJGMhl2PjNp2ZwrSYZE_iWapWN2tpd_z6PMC__mxw4QsLYESE6cma7gge5S6Oyn552CgolPzFnVqgWid9Bbl3l-XLYJUue7lu2YswJxXTnduNVxBNi9DbKRIaFhXo6_L_AjgnbE/s728-rw-e365/ssh.png align="center") ## **Introduction to the Vulnerability** 1. **CVE-2025-26465: Machine-in-the-Middle (MITM) Attack on OpenSSH Client** * Severity: High * Impact: Attackers can steal data and hijack SSH sessions without user interaction. * Exploitation conditions: * When the VerifyHostKeyDNS option is enabled (default is off, but it can be activated in some configurations, especially on FreeBSD). * No need for SSHFP resource records in DNS. 2. **CVE-2025-26466: Denial of Service (DoS) Attack on Both Client & Server** * Severity: High * Impact: * Pre-authentication DoS attack, causing the system to consume resources (RAM, CPU), disrupting SSH services. * May prevent administrators from logging in, halting critical operations. ## **Affected Versions** * OpenSSH versions 6.8p1 to 9.9p1 * OpenSSH versions 9.5p1 to 9.9p1 ## **Vulnerability Analysis** 1. **CVE-2025-26465** * **Man-in-the-Middle (MitM) attack** is a technique where an attacker inserts themselves between the connection of a client and a server to steal information or impersonate identities. In OpenSSH, MitM can occur if server key authentication is not done correctly. * Initially, for attackers to exploit this vulnerability, the VerifyHostKeyDNS option must be enabled. Specifically, the function `sshkey_to_base64()`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740626367315/d50f9976-0bbe-44ad-85f7-2a728c6a4aab.png align="center") * This Base64 code is responsible for converting an SSH key into **Base64** format, which may relate to **CVE-2025-26465** if it mishandles data during server key verification. * The variable `r` is initially set to `SSH_ERR_INTERNAL_ERROR`, but if there's an error in `sshkey_putb()` or `sshbuf_dtob64_string()`, the function will `goto out` without freeing memory. * If `sshbuf_dtob64_string()` fails (`NULL`), it returns `SSH_ERR_ALLOC_FAIL`, but it may not handle all exception cases. * If an attacker can control the value passed into `sshkey_to_base64()`, they can exploit this flaw to corrupt memory or cause data leaks in OpenSSH. * Ultimately, once the exploit is successful, attackers can steal credentials and take control of the session. 2. **CVE-2025-26466** * The vulnerability **CVE-2025-26466** in OpenSSH allows attackers to perform a denial-of-service (DoS) attack before authentication by exploiting asymmetric resource consumption of memory and CPU. * Initially, attackers exploit **CVE-2025-26466** by sending a series of `SSH2_MSG_PING` packets to the server. Each packet causes the server to create an `SSH2_MSG_PONG` packet and store it in memory before sending it. * By continuously sending requests, and if the number of `PING` packets is large enough, the server's memory can be exhausted, leading to a denial of service. * Besides consuming the victim's system memory, attackers also target the CPU. * After completing the key exchange process, the server processes the stored `SSH2_MSG_PONG` packets. This is done inefficiently, leading to a spike in CPU usage when handling a large number of packets, causing service disruption. ## **Signs to Recognize** 1. **Signs to Recognize CVE-2025-26465 Attack** * **Unusual SSH Connection:** * Detect SSH connections coming from unknown IP addresses or those not on the trusted list. * Sudden spikes in SSH traffic or traffic appearing at unusual times. * **Server Key Authentication Warning:** * The SSH client shows a warning about a server key change when connecting to a familiar server. * Notifications about server key mismatches or requests to re-confirm the server key. * **Suspicious Network Traffic:** * Detect network traffic that appears to be blocked or redirected through unidentified intermediary devices. * The presence of unusual or unexpected packets during the SSH connection setup process. 2. **Signs to Recognize CVE-2025-26466 Attack** * Unusual use of system resources: * Detect sudden spikes in CPU and memory usage on the OpenSSH server without a clear reason. * The system becomes slow or unresponsive due to excessive resource consumption. * Suspicious Network Traffic: * A large number of `SSH2_MSG_PING` packets appear from one or more unknown IP addresses, sent to the server in a short period of time. * A sudden spike in SSH traffic without a corresponding increase in legitimate activity. * SSH Service Incident: * The SSH service frequently experiences issues, restarts, or stops working without a clear reason. * Administrators have difficulty connecting to or managing the server through SSH due to the unstable service. ## **Recommendations** 1. **CVE-2025-26465 - Man-in-the-Middle Attack** * **Update to OpenSSH 9.9p2 or later.** * **Disable** `VerifyHostKeyDNS` if it's not really necessary. * **Use manual SSH fingerprint** to verify the server. 2. **CVE-2025-26466 - Denial of Service Attack** * **Update to OpenSSH 9.9p2 or later.** * **Configure SSH connection limits** using `MaxStartups`, `LoginGraceTime`, `PerSourcePenalties`. * **Monitor SSH traffic** to detect unusual behavior. ## **Conclusion** Security researchers have discovered two critical vulnerabilities in **OpenSSH**, allowing attackers to perform **Man-in-the-Middle (MitM) and Denial of Service (DoS) attacks**. These vulnerabilities pose serious risks to **public SSH servers** and systems using OpenSSH. Updating to the latest version and applying security measures will help reduce the risk of attacks. ## **References** 1. [New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now](https://thehackernews.com/2025/02/new-openssh-flaws-enable-man-in-middle.html) 2. [Qualys TRU Disc](https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466?utm_source=chatgpt.com)[overs Two Vulnerabilities in OpenSSH: CVE-2025-26465 & CVE-2025-26466 | Qualys Security Blog](https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466) 3. [qualys.com/2025/02/18/openssh-mitm-dos.txt](http://qualys.com/2025/02/18/openssh-mitm-dos.txt) 4. [OpenSSH Vulnerabilities CVE-2025-26465 and CVE-2025-26466 Enable Man-in-the-Middle and DoS Attacks - Upwind](https://www.upwind.io/feed/openssh-vulnerabilities-cve-2025-26465-and-cve-2025-26466-enable-man-in-the-middle-and-dos-attacks?utm_source=chatgpt.com)