407 matches found
SSH ssh-keygen with Secure-RPC SUN-DES-1 Phrase Recovery
The remote host is running a version of SSH Communications Security SSH comprised between versions 1.2.27 and 1.2.30. With Secure-RPC, this version can allow local attackers to recover a SUN-DES-1 magic phrase generated by another user, which the attacker can use to decrypt that user's private ke...
CVE-2002-1715
SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access...
CVE-2002-2379
Cisco AS5350 IOS 12.211T with access control lists ACLs applied and possibly with ssh running allows remote attackers to cause a denial of service crash via a port scan, possibly due to an ssh bug. NOTE: this issue could not be reproduced by the vendor...
SSH Secure Shell without PTY setsid() Function Privilege Escalation
According to its banner, the version of SSH Secure Shell running on the remote host is between 2.0.13 and 3.2.1. There is a bug in such versions that may allow a non-interactive shell session, such as used in scripts, to obtain higher privileges due to a flaw in the way setsid is used. C Tenable...
Netscreen SSH1 CRC32 Compensation Denial of service
Discovered by: HD Moore Products Tested: Netscreen-25 All models expected to be vulnerable Vendor contacted: October 23rd Vendor confirmed: October 23rd CVE: CVE-2001-0144 covered this bug. Original Bug discovered by: Michal Zalewski of the BindView RAZOR Team. In February of 2001, BindView's RAZ...
CVE-2002-1024
Cisco IOS 12.0 through 12.2, when supporting SSH, allows remote attackers to cause a denial of service CPU consumption via a large packet that was designed to exploit the SSH CRC32 attack detection overflow CVE-2001-0144...
Certain implementations of SSH1 may reveal internal cryptologic state
Overview An implementation problem in at least one Secure Shell SSH product and a weakness in the PKCS11.5 public key encryption standard allows attackers to recover plaintext of messages encrypted with SSH. Description A weakness in some SSH products using the SSH1 protocol may allow an attacker...
Arbitrary Code Execution
Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication ChallengeResponseAuthentication when OpenSSH is using SKEY or...
SSHD allows users to override "AllowedAuthentications" configuration thereby permitting users to provide any type of authentication
Overview A remotely exploitable authentication vulnerability exists in the SSH Communications Security SSH Secure Shell server, and possibly other SSH servers. Description SSH is a program used to provide secure communications between hosts. Versions 3.0.0 - 3.1.1 of SSH Secure Shell for Servers...
SSH (x2) - Remote Command Execution
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/349.tgz x2.tgz milw0rm.com 2002-05-01...
SSH (x2) - Remote Command Execution
SSH x2 - Remote Command Execution https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/349.tgz x2.tgz milw0rm.com 2002-05-01...
CVE-1999-1159
SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root...
[SECURITY] [DSA 086-1] New versions of ssh-nonfree & ssh-socks fix buffer overflow
Package: ssh-nonfree, ssh-socks Vulnerability: remote root exploit Debian-specific: no We have received reports that the "SSH CRC-32 compensation attack detector vulnerability" is being actively exploited. This is the same integer type error previously corrected for OpenSSH in DSA-027-1. OpenSSH...
Weaknesses in the SSH protocol simplify brute-force attacks against passwords typed in an existing SSH session
Overview There is a vulnerability in the SSH protocol that can simplify brute force attacks against passwords typed within an existing SSH session. Description Researchers at the University of California at Berkeley have determined that by monitoring the delays between SSH packets transmitted...
CVE-1999-1231
ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server...
SSH2 3.0 - Short Password Login
source: https://www.securityfocus.com/bid/3078/info An input validation error exists in version 3.0.0 of the SSH daemon sshd running on Unix platforms. It may be possible for remote users to log in to accounts for which there are two or less characters in the password field of the system password...
SSH 3.0.0 Locked Account Remote Authentication Bypass
The remote host is running SSH 3.0.0. There is a bug in this release which allows any user to log into accounts whose password entry is two characters long or less. An attacker might gain root privileges using this flaw. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...
SSH1 may generate weak passphrase when using Secure RPC
Overview The secure-RPC feature of the SSH1 client in Solaris sometimes encrypts the SSH private key file with a weak passphrase, which can be determined by an attacker and used to recover the SSH private keys. Other versions of the SSH client running on non-Solaris platforms are not affected by...
CVE-2001-0259
ssh-keygen in ssh 1.2.27 - 1.2.30 with Secure-RPC can allow local attackers to recover a SUN-DES-1 magic phrase generated by another user, which the attacker can use to decrypt that user's private key file...