PuTTY wish ssh2-cisco-pw-pad

This is a mirror. Follow this link to find the primary PuTTY web site.

summary: Cisco SSH-2 servers can't handle over-padded packets
class: wish: This is a request for an enhancement.
difficulty: tricky: Needs many tuits.
priority: low: We aren't sure whether to fix this or not.
absent-in: 0.55
present-in: 0.58
fixed-in: 2007-01-08 r7073 274f6a60f7db1fb61657387db3c135b25cff749b (0.59)

It appears that the SSH-2 server in some versions of Cisco CatOS (version string "SSH-2.0-Cisco-1.25") is unable to cope with the additional padding that PuTTY puts on packets containing passwords in order to mask their length. This additional padding is permitted by the SSH-2 specification, which merely requires:

      random padding
         Arbitrary-length padding, such that the total length of
         (packet_length || padding_length || payload || random padding)
         is a multiple of the cipher block size or 8, whichever is
         larger.  There MUST be at least four bytes of padding.  The
         padding SHOULD consist of random bytes.  The maximum amount of
         padding is 255 bytes.

This can be solved by reverting to sending an SSH_MSG_IGNORE immediately after the password, either for all connections or just when talking to broken Cisco servers. Alternatively, we could just accept guessable password lengths when talking to broken servers.

SGT, 2007-01-07: I've now reverted to the IGNORE message universally, which should fix it.

If you want to comment on this web site, see the Feedback page.

Audit trail for this wish.

(last revision of this bug record was at 2021-07-03 11:50:19 +0100)