SSH Supports Weak Cipher

Description

The SSH server is configured to support either Arcfour or Cipher Block Chaining (CBC) mode cipher algorithms. SSH can be configured to use Counter (CTR) mode encryption instead of CBC. The use of Arcfour algorithms should be disabled.

How is this issue discovered?

The following nmap command can be run to independently validate the presence of weak ssh cipher suites:

nmap --script ssh2-enum-algos target

The following 3rd party site can also be used for validation: sshcheck.com

Remediation

Example for the configuration of the SSH server.
Blog post on configuration for Weak ciphers (CBC) and MAC algorithms

The following open source program can be used to check for SSH protocols and configurations: SSHScan on Github

All OpenSSH versions between 5.4 and 7.1 are vulnerable, but can be easily hot-fixed by setting the undocumented option "UseRoaming" to "no", as detailed in the Mitigating Factors section. OpenSSH version 7.1p2 (released on January 14, 2016) disables roaming by default.

How can this issue be resolved?

• I have fixed this
  • SSH connections to the host are now being rejected or timed-out. 
  • The protocol is now updated to the latest patch and the ciphers are no longer weak.
  • The host has been removed from the network, SSH is now impossible to connect to the IP.
  • Arc four and CBC ciphers are no longer possible ciphers on the machine.

• I have a compensating control
  • There is no valid compensating control for this issue type

• This is not my IP or domain
  • This does not belong to our company, it belongs to (x).
  • The IP is no longer part of our network.

• I cannot reproduce this issue and I think it’s incorrect
  • The SSH ciphers are updated to the latest version, there is no vulnerable protocol in place.
  • The IP is no longer online, the finding is not valid.