PT-2001-2566 · Openssh · Ssh

Published 2001-01-18 · Updated 2017-07-11 · CVE-2001-1476

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SSH versions prior to 2.0

Description The issue makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications. This is possible when RC4 encryption is used and the "disallow NULL passwords" option is enabled, triggering different messages depending on whether the guess is correct or not.

Recommendations For SSH versions prior to 2.0, consider disabling RC4 encryption and the "disallow NULL passwords" option as a temporary workaround until a patch is available. Restrict access to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2001-1476

Affected Products

Ssh

References · 3

• 🔥 http://kb.cert.org/vuls/id/565052 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1476 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6490 · Note