CVE-2002-1646

SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2002-05/0204.html	Patch
http://www.ssh.com/products/ssh/advisories/authentication.cfm	Patch
http://www.kb.cert.org/vuls/id/341187	US Government Resource
http://www.securityfocus.com/bid/4810	Patch
http://www.ciac.org/ciac/bulletins/m-081.shtml
http://www.ssh.com/company/newsroom/article/201/
https://exchange.xforce.ibmcloud.com/vulnerabilities/9163

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ssh:secure_shell_for_servers:3.0:::::::*
	cpe:2.3:a:ssh:secure_shell_for_servers:3.0.1:::::::*
	cpe:2.3:a:ssh:secure_shell_for_servers:3.1:::::::*
	cpe:2.3:a:ssh:secure_shell_for_servers:3.1.1:::::::*

Information

Published : 2002-12-30 21:00

Updated : 2017-07-10 18:29

NVD link : CVE-2002-1646

Mitre link : CVE-2002-1646

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

ssh

secure_shell_for_servers

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0204.html", "name": "20020523 [Fwd: Updated version of SSH Secure Shell available]", "tags": ["Patch"], "refsource": "BUGTRAQ"}, {"url": "http://www.ssh.com/products/ssh/advisories/authentication.cfm", "name": "http://www.ssh.com/products/ssh/advisories/authentication.cfm", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.kb.cert.org/vuls/id/341187", "name": "VU#341187", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/4810", "name": "4810", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://www.ciac.org/ciac/bulletins/m-081.shtml", "name": "M-081", "tags": [], "refsource": "CIAC"}, {"url": "http://www.ssh.com/company/newsroom/article/201/", "name": "http://www.ssh.com/company/newsroom/article/201/", "tags": [], "refsource": "CONFIRM"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9163", "name": "ssh-allowedauthentications-bypass-auth(9163)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2002-1646", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2002-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ssh:secure_shell_for_servers:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ssh:secure_shell_for_servers:3.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ssh:secure_shell_for_servers:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ssh:secure_shell_for_servers:3.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:29Z"}