Two keys to rule them all: Cisco warns of default SSH keys on appliances

Cisco revealed a security vulnerability in a number of the company's network security virtual appliances that could give someone virtually unlimited access to them—default, pre-authorized keys for Secure Shell (SSH) sessions originally intended for "customer support" purposes. As Threatpost's Dennis Fisher reported, Cisco has released software patches that correct the problem, but there's no temporary workaround for systems that can't immediately be patched.

Cisco released an advisory on the vulnerability on June 25. There are two separate SSH key vulnerabilities for the Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv).

The first is that these virtual machines, which run on VMware and KVM virtualization platforms, share a default authorized SSH key for remote login. "IP address connectivity to the management interface on the affected platform is the only requirement for the products to be exposed to this vulnerability," Cisco warned. "No additional configuration is required for this vulnerability to be exploited."

That means that if an attacker has obtained the key for one Cisco virtual appliance, he or she could use that key to connect to any other virtual appliance reachable over the Internet—and have all the privileges of a root user on that system.

The common default key was apparently inserted into the software, Fisher reported, for "support reasons."

The second vulnerability on the same set of virtual appliances is "a preinstalled set of SSH host keys that allow access to communication secured by those keys," Cisco's security team warned in the advisory. These keys are used to protect appliance-to-appliance communications. "Because all deployments of WSAv or ESAv use the same set of default SSH host keys, accessing any of the private keys on a single deployment could allow an attacker to decrypt communication on WSAv, ESAv, or SMAv," the advisory stated. "At attacker with possession of compromised keys, who is able to intercept traffic between the WSAv or ESAv and a host it is communicating with, would be able to decrypt the communication with a man-in-the-middle attack."