critical CVSS 9 EPSS 71% Public exploit available

CVE-2008-0166·OpenSSH vulnerability

OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.

Severity
critical
Software
OpenSSH
Fixed in
4.7p1-9
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 71% — in the top 0.6% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 4.7p1-9

Fixed in: 4.7p1-9

How to fix this CVE

Upgrade OpenSSH to version 4.7p1-9 or later to resolve the weak random number generator vulnerability in the underlying OpenSSL library. This vulnerability allows attackers to predict SSH host keys and user keys, compromising the confidentiality of encrypted connections. Immediately patch all affected systems, as this affects the cryptographic foundation of SSH authentication.

sudo dnf update openssh-server openssh-clients

Defensia detects this vulnerability

How to check if you are affected

  1. Check the installed OpenSSH version: ssh -V or sshd -v
  2. Verify if the system runs Debian-based OS with vulnerable OpenSSL: dpkg -l | grep openssl
  3. Review SSH host key generation timestamps: stat -c %y /etc/ssh/ssh_host_* to identify when keys were generated
  4. Confirm remediation by re-running ssh -V and verifying the version is 4.7p1-9 or later
  5. Regenerate SSH host keys after patching: sudo ssh-keygen -A (this ensures strong keys are in use)

FAQ

What is CVE-2008-0166?

CVE-2008-0166 is a vulnerability in Debian-based OpenSSL packages where the random number generator is severely weakened, allowing attackers to predict SSH cryptographic keys through brute force attacks. This undermines the security of all SSH connections relying on affected key material.

Is CVE-2008-0166 being actively exploited?

While not currently listed as actively exploited by CISA, public exploits are available. This vulnerability was discovered in 2008 and widely publicized, making it a known attack vector for systems that were not promptly patched at the time.

What versions of OpenSSH are affected by CVE-2008-0166?

OpenSSH versions up to 4.7p1-9 on Debian-based systems are affected. The vulnerability stems from OpenSSL 0.9.8c-1 through 0.9.8g-8 on Debian, affecting any OpenSSH version using those OpenSSL versions.

How do I check if my server is vulnerable to CVE-2008-0166?

Run 'ssh -V' to check the OpenSSH version. If it is 4.7p1-8 or earlier on a Debian-based system, and 'dpkg -l | grep openssl' shows version 0.9.8c-1 to 0.9.8g-8, your system is vulnerable.

Why do I need to regenerate SSH keys after patching?

Any SSH keys generated on systems running the vulnerable OpenSSL were predictable and compromised. After patching, regenerate all host keys and user keys to ensure strong cryptographic material is in use going forward.

Does Defensia detect CVE-2008-0166?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2008-0166 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2024-6387CVSS 8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2008-0166. Free for 1 server.

Get started free