CVE-2002-0639
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote at ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD.
Descripción
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | openssh | 1:3.4 |
| debian 12 | openssh | 1:3.4 |
| debian 13 | openssh | 1:3.4 |
| debian 14 | openssh | 1:3.4 |
| echo | openssh | 1:3.4 |
| root.io debian 11 | rootio-openssh | 1:3.4 |
| root.io debian 12 | rootio-openssh | 1:3.4 |
| root.io debian 13 | rootio-openssh | 1:3.4 |
Referencias
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txt
- http://archives.neohapsis.com/archives/bugtraq/2002-06/0335.html
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502
- http://marc.info/?l=bugtraq&m=102514371522793&w=2
- http://marc.info/?l=bugtraq&m=102514631524575&w=2
- http://marc.info/?l=bugtraq&m=102521542826833&w=2
- http://www.cert.org/advisories/CA-2002-18.html
- http://www.debian.org/security/2002/dsa-134
Las 17 referencias
- http://www.iss.net/security_center/static/9169.php
- http://www.kb.cert.org/vuls/id/369347
- http://www.linuxsecurity.com/advisories/other_advisory-2177.html
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:040
- http://www.osvdb.org/6245
- http://www.securityfocus.com/bid/5093
- http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195
- https://twitter.com/RooneyMcNibNug/status/1152332585349111810
- https://web.archive.org/web/20080622172542/www.iss.net/threats/advise123.html