PT-2001-1488 · Openssh+1 · Ssh-Keygen+2

Published 2001-05-07 · Updated 2017-10-10 · CVE-2001-0259

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ssh versions 1.2.27 through 1.2.30

Description The issue allows local attackers to recover a SUN-DES-1 magic phrase generated by another user. This magic phrase can then be used to decrypt the user's private key file.

Recommendations For versions 1.2.27 through 1.2.30, consider restricting access to the ssh-keygen utility until a fix is available. As a temporary workaround, users should be cautious when using Secure-RPC to generate SUN-DES-1 magic phrases.

Exploit

Fix

Related Identifiers

CVE-2001-0259

Affected Products

Secure-Rpc

Ssh

Ssh-Keygen

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2001-01/0262.html · Exploit
• 🔥 http://ssh.com/products/ssh/patches/secureRPCvulnerability.html · Exploit
• 🔥 http://securityfocus.com/bid/2222 · Exploit
• 🔥 https://exploit-db.com/exploits/20560 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-0259 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5963 · Note