PT-2002-2370 · Ssh · Ssh Secure Shell For Servers

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1646

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSH Secure Shell for Servers versions 3.0.0 through 3.1.1

Description The issue allows remote attackers to override the AllowedAuthentications configuration, enabling the use of less secure authentication schemes, such as password authentication, even if the server is configured to use more secure methods.

Recommendations For versions 3.0.0 through 3.1.1, update the configuration to explicitly disable less secure authentication schemes and ensure that only configured secure authentication methods are used. As a temporary workaround, consider restricting access to the SSH server until a more secure configuration can be implemented.

Correção

Identificadores relacionados

CVE-2002-1646

Produtos afetados

Ssh Secure Shell For Servers

Referências · 8

• http://securityfocus.com/bid/4810 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-1646 · Nota de Segurança
• http://ssh.com/products/ssh/advisories/authentication.cfm · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/9163 · Nota
• http://ssh.com/company/newsroom/article/201 · Nota
• http://ciac.org/ciac/bulletins/m-081.shtml · Nota
• http://kb.cert.org/vuls/id/341187 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2002-05/0204.html · Correção