---
title: "CVE-2008-5161\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2008-5161?format=md
keywords: index, follow
---

# CVE-2008-5161

Publication date 19 November 2008

Last updated 6 June 2026

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**3.7 · Low**

[Score breakdown](https://ubuntu.com/security/CVE-2008-5161?format=md#impact-score)

Toggle side navigation

## Description

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and
Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8;
Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on
IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and
6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2)
OpenSSH 4.7p1 and possibly other versions, when using a block cipher
algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote
attackers to recover certain plaintext data from an arbitrary block of
ciphertext in an SSH session via unknown vectors.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2008-5161?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| openssh | 13.04 raring | Not affected |
| 12.10 quantal | Not affected |
| 12.04 LTS precise | Not affected |
| 11.10 oneiric | Not affected |
| 11.04 natty | Not affected |
| 10.10 maverick | Not affected |
| 10.04 LTS lucid | Not affected |
| 9.10 karmic | Ignored end of life |
| 9.04 jaunty | Ignored end of life |
| 8.10 intrepid | Ignored end of life, was needed |
| 8.04 LTS hardy | Ignored end of life |
| 7.10 gutsy | Ignored end of life, was needed |
| 6.06 LTS dapper | Ignored end of life |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [jdstrand](https://launchpad.net/~jdstrand)

very difficult to exploit
as of 1:5.1p1-5 (Ubuntu 9.04 and later), the packet\_disconnect()
patch helps mitigate this and should reduce the success probability for the
CPNI-957037 Plaintext Recovery Attack to 2^-18.
can backport packet\_disconnect() patch to 8.10 with next update.
Will have to review feasibility of backport to 8.04 and 6.06 at next update.
mitigation is to use AES CTR and arcfour ciphers and prefer them
using the following line in sshd\_config and ssh\_config:
Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

3.7 · Low

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | High |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | Low |
  | Integrity impact | None |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 3.7 · Low |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5161)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2008-5161)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2008-5161)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2008-5161)

### Other references

* <http://www.openssh.com/txt/cbc.adv>
* <https://www.cve.org/CVERecord?id=CVE-2008-5161>