Lucene search

K
f5F5F5:K17448
HistoryOct 16, 2015 - 12:00 a.m.

K17448 : OpenSSH vulnerability CVE-2001-1473

2015-10-1600:00:00
my.f5.com
116

6.4 Medium

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

63.5%

Security Advisory Description

The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target’s public key, which allows the attacker to compute the corresponding private key and use the target’s Session ID with the compromised key pair to masquerade as the target.(CVE-2001-1473)

Impact

When SSH protocol version 1 is enabled on the SSHD service, it is possible for a man-in-the-middle attack to perform replay attacks. All supported releases of BIG-IP, BIG-IQ, and Enterprise Manager do not enable the use of this protocol by default.

6.4 Medium

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

63.5%

Related for F5:K17448