RHEL 2.1 : openssh (RHSA-2003:224)

Updated OpenSSH packages are now available. These updates close an information leak caused by sshd's interaction with the PAM system. OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login...

Multiple IKE bugs

Type of cerificate is not checked. If XAUTH if used in IKE phase I, it's possible to user proxy attack for challenge-response based authentication...

DEBIAN-CVE-2003-0786

The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges...

PT-2003-1877 · Openssh +1 · Openssh +1

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 3.7.1 through 3.7.1p1 Description: The issue concerns the SSH1 PAM challenge response authentication mechanism in OpenSSH. When Privilege Separation is disabled, the authentication attempt result is not properly checked,...

CVE-2002-0639

CVE-2002-0639 concerns an integer overflow in sshd of OpenSSH 2.9.9–3.3 that enables remote code execution during ChallengeResponseAuthentication when SKEY or BSD_AUTH are used. The connected data confirms the CVE exists and notes a related entry, CVE-2002-0390, was reserved as a duplicate of CVE...

CVE-2002-0639

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication ChallengeResponseAuthentication when OpenSSH is using SKEY or BSDAUTH authentication...

Buffer overflow in OpenSSH Challenge-response

Integer overflow during challenge-response processing. Buffer overflow on large number of responses...

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

VNC authentication weakness

VNC authentication weakness --------------------------- VNC uses a DES-encrypted challenge-response system to avoid passing passwords over the wire in plaintext. However, it seems that a weakness in the way the challenge is generated by some servers would make this useless. The following program...

Weak encryption in VNC

Duplicated challenges are generated during challenge-response authentication...

CVE-2002-0640

Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication PAMAuthenticationViaKbdInt...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication ChallengeResponseAuthentication when OpenSSH is using SKEY or...

DEBIAN-CVE-2002-0639

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication ChallengeResponseAuthentication when OpenSSH is using SKEY or BSDAUTH authentication...

CVE-2002-0640

Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication PAMAuthenticationViaKbdInt...

PT-2002-1074 · Openssh +1 · Openssh +1

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 2.3.1 through 3.3 openssh-askpass-3.1p1 openssh-askpass-gnome-3.1p1 openssh-clients-3.1p1 openssh-server-3.1p1 openssh-3.1p1 Description: The issue concerns multiple vulnerabilities in OpenSSH, which can be exploited remotely...

PT-2002-1676 · Openssh +1 · Openssh +1

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 2.9.9 through 3.3 Description: An integer overflow in sshd within OpenSSH versions 2.9.9 through 3.3 can allow remote attackers to execute arbitrary code during ChallengeResponseAuthentication when OpenSSH is configured to us...

Advisory CA-2002-18 OpenSSH Vulnerabilities in Challenge Response

CERT Advisory CA-2002-18 OpenSSH Vulnerabilities in Challenge Response Handling Original release date: June 26, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected OpenSSH versions 2.3.1p1 through 3.3 Overview There are two...

OpenSSH vulnerabilities in challenge response handling

Overview There are two related vulnerabilities in the challenge response handling code in OpenSSH versions 2.3.1p1 through 3.3. They may allow a remote intruder to execute arbitrary code as the user running sshd often root. The first vulnerability affects OpenSSH versions 2.9.9 through 3.3 that...

OpenSSH 3.x - Challenge-Response Buffer Overflow (1)

OpenSSH 3.x - Challenge-Response Buffer Overflow 1 source: https://www.securityfocus.com/bid/5093/info The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges. The conditions are related to th...

OpenSSH 3.x - Challenge-Response Buffer Overflow (2)

OpenSSH 3.x - Challenge-Response Buffer Overflow 2 source: https://www.securityfocus.com/bid/5093/info The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges. The conditions are related to th...