CVE-2002-0639

Severity

99%

Complexity

99%

Confidentiality

165%

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.

CVSS 2.0 Base Score 9.9. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C).

Overview

Type

OpenBSD OpenSSH

First reported 22 years ago

2002-07-03 04:00:00

Last updated 8 years ago

2016-10-18 02:20:00

Affected Software

OpenBSD OpenSSH 1.2.2

1.2.2

OpenBSD OpenSSH 1.2.3

1.2.3

OpenBSD OpenSSH 2.1

2.1

OpenBSD OpenSSH 2.1.1

2.1.1

OpenBSD OpenSSH 2.2

2.2

OpenBSD OpenSSH 2.3

2.3

OpenBSD OpenSSH 2.5

2.5

OpenBSD OpenSSH 2.5.1

2.5.1

OpenBSD OpenSSH 2.5.2

2.5.2

OpenBSD OpenSSH 2.9

2.9

OpenBSD OpenSSH 2.9.9

2.9.9

OpenBSD OpenSSH 2.9 p1

2.9p1

OpenBSD OpenSSH 2.9 p2

2.9p2

OpenBSD OpenSSH 3.0

3.0

OpenBSD OpenSSH 3.0.1

3.0.1

OpenBSD OpenSSH 3.0.1 p1

3.0.1p1

OpenBSD OpenSSH 3.0.2

3.0.2

OpenBSD OpenSSH 3.0.2p1

3.0.2p1

OpenBSD OpenSSH 3.0 p1

3.0p1

OpenBSD OpenSSH 3.1

3.1

OpenBSD OpenSSH 3.1 p1

3.1p1

OpenBSD OpenSSH 3.2

3.2

OpenBSD OpenSSH 3.2.2 p1

3.2.2p1

OpenBSD OpenSSH 3.2.3 p1

3.2.3p1

OpenBSD OpenSSH 3.3

3.3

OpenBSD OpenSSH 3.3 p1

3.3p1

References

CSSA-2002-030.0

20020626 [OpenPKG-SA-2002.005] OpenPKG Security Advisory (openssh)

CLA-2002:502

20020626 OpenSSH Security Advisory (adv.iss)

20020626 Revised OpenSSH Security Advisory (adv.iss)

20020627 How to reproduce OpenSSH Overflow.

CA-2002-18

US Government Resource

DSA-134

openssh-challenge-response-bo(9169)

VU#369347