PT-2001-2566 · Openssh · Ssh

Publicado 2001-01-18 · Atualizado 2017-07-11 · CVE-2001-1476

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSH versions prior to 2.0

Description The issue makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications. This is possible when RC4 encryption is used and the "disallow NULL passwords" option is enabled, triggering different messages depending on whether the guess is correct or not.

Recommendations For SSH versions prior to 2.0, consider disabling RC4 encryption and the "disallow NULL passwords" option as a temporary workaround until a patch is available. Restrict access to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-1476

Produtos afetados

Ssh

Referências · 3

• 🔥 http://kb.cert.org/vuls/id/565052 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1476 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6490 · Nota