Published: 03/07/2002 Updated: 18/10/2016

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Buffer overflow in sshd in OpenSSH 2.3.1 up to and including 3.3 may allow remote malicious users to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openssh 2.3
openbsd openssh 2.5
openbsd openssh 3.0.1
openbsd openssh 3.0.1p1
openbsd openssh 3.2.2p1
openbsd openssh 3.2.3p1
openbsd openssh 2.1.1
openbsd openssh 2.2
openbsd openssh 2.9p2
openbsd openssh 3.0
openbsd openssh 3.1p1
openbsd openssh 3.2
openbsd openssh 1.2.2
openbsd openssh 2.5.1
openbsd openssh 2.5.2
openbsd openssh 2.9
openbsd openssh 3.0.2
openbsd openssh 3.0.2p1
openbsd openssh 3.3
openbsd openssh 3.3p1
openbsd openssh 1.2.3
openbsd openssh 2.1
openbsd openssh 2.9.9
openbsd openssh 2.9p1
openbsd openssh 3.0p1
openbsd openssh 3.1

ISS X-Force released an advisory about an OpenSSH "Remote Challenge Vulnerability" Unfortunately, the advisory was incorrect on some points, leading to widespread confusion about the impact of this vulnerability No version of OpenSSH in Debian is affected by the SKEY and BSD_AUTH authentication methods described in the ISS advisory However, Debi ...

source: wwwsecurityfocuscom/bid/5093/info The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges The conditions are related to the OpenSSH SSH2 challenge-response mechanism They occur when the OpenSSH server is configured at compil ...

source: wwwsecurityfocuscom/bid/5093/info The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges The conditions are related to the OpenSSH SSH2 challenge-response mechanism They occur when the OpenSSH server is configured at comp ...

NVD-CWE-Other http://www.kb.cert.org/vuls/id/369347 http://www.cert.org/advisories/CA-2002-18.html http://www.debian.org/security/2002/dsa-134 http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195 http://www.securityfocus.com/bid/5093 http://www.redhat.com/support/errata/RHSA-2002-131.html ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502 http://www.linuxsecurity.com/advisories/other_advisory-2177.html http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:040 http://www.novell.com/linux/security/advisories/2002_024_openssh_txt.html http://www.redhat.com/support/errata/RHSA-2002-127.html http://www.osvdb.org/839 http://marc.info/?l=bugtraq&m=102532054613894&w=2 http://marc.info/?l=bugtraq&m=102514371522793&w=2 http://marc.info/?l=bugtraq&m=102514631524575&w=2 http://marc.info/?l=bugtraq&m=102521542826833&w=2 https://nvd.nist.gov https://www.debian.org/security/./dsa-134 https://www.exploit-db.com/exploits/21578/

CVE-2002-0640

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect