Hint: disable SSH v2 on 5300XLs!

[Markku Leinio]

Based on my experiences, I strongly advice all Procurve 5300XL users to disable SSH version 2 support.

In a certain way it is possible to cause the 5300XL to reload (system crash) by a remote SSH v2 connection attempt, with any password (even incorrect password). All the cracker needs is a 5300XL waiting for SSH v2 connection and access to that listening port.

HP is still investigating this issue. I have seen this in both our 5300XLs (configured for totally different environments and by different people) running various software versions E.07.xx, including the latest E.07.30, with SSH version 2 server enabled. With SSH version 1 server I haven't been able to crash the switch.

My suggestion is to use only SSH version 1 or to prevent port 22 access from untrusted addresses by access control lists.

Hopefully HP will get a fix for this soon. I will report here any progress on this case.

[Markku Leinio]

Just to keep you awake: no further comments from HP dispite the fact that they were first contacted with this issue in May.

[Mark Landin]

Not even a security bulletin?

You might try spreading this info around some of the more well-known security and bugtracking sites. Sometimes a little publicity can motivate a reticent vendor...

[Markku Leinio]

I am not aware of any kind of notices by HP in this issue.

After reporting my experiences the engineers said that they tested it, but didn't find the same situation. They suspected that the 10/100 modules were defective (according to the date codes in the boards) and I was sent new modules, which I installed. Nothing changed, however, the fault remains.

I tried with 07.2x and 07.30 firmware, they are equal with this issue.

Two weeks ago we got our second 5304XL (with 100/1000T and mini-GBIC modules only). I immediately tested it, and the same fault occurred. I don't believe this is a hardware issue.

I will still try the HP e-mail support, and then I'll consider some other actions.

[Markku Leinio]

Looks like E.08.01 doesn't have that problem anymore. I would still keep from using SSH v2 in 5300XL yet.