Mirrors | Updates | Feedback | Changes | Wishlist | Team
It appears that the SSH-2 server in some versions of Cisco CatOS (version string "SSH-2.0-Cisco-1.25") is unable to cope with the additional padding that PuTTY puts on packets containing passwords in order to mask their length. This additional padding is permitted by the SSH-2 specification, which merely requires:
random padding Arbitrary-length padding, such that the total length of (packet_length || padding_length || payload || random padding) is a multiple of the cipher block size or 8, whichever is larger. There MUST be at least four bytes of padding. The padding SHOULD consist of random bytes. The maximum amount of padding is 255 bytes.
This can be solved by reverting to sending an SSH_MSG_IGNORE immediately after the password, either for all connections or just when talking to broken Cisco servers. Alternatively, we could just accept guessable password lengths when talking to broken servers.
SGT, 2007-01-07: I've now reverted to the IGNORE message universally, which should fix it.
Audit trail for this wish.