PT-2001-2565 · Openssh · Ssh

Published 2001-01-18 · Updated 2017-07-11 · CVE-2001-1475

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSH versions prior to 2.0

Description The issue allows remote attackers to replay messages until a new server key is generated, when using RC4 and password authentication.

Recommendations For SSH versions prior to 2.0, consider updating to version 2.0 or later to resolve the issue. As a temporary workaround, consider regenerating the server key (VK) more frequently to minimize the risk of exploitation. Restrict access to password authentication using RC4 to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2001-1475

Affected Products

Ssh

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2001-1475 · Security Note
• http://kb.cert.org/vuls/id/665372 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6490 · Note