PT-2003-1877 · Openssh+1 · Openssh+1

Petri Heinonen · Published 2003-09-25 · Updated 2024-07-08 · CVE-2003-0786

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenSSH versions 3.7.1 through 3.7.1p1

Description: The issue concerns the SSH1 PAM challenge response authentication mechanism in OpenSSH. When Privilege Separation is disabled, the authentication attempt result is not properly checked, potentially allowing remote attackers to gain privileges.

Recommendations: For OpenSSH versions 3.7.1 through 3.7.1p1, consider enabling Privilege Separation to mitigate the risk of exploitation. As a temporary workaround, restrict access to the SSH1 PAM challenge response authentication mechanism until a patch is available.

Exploit

Fix

Related Identifiers

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

CVE-2003-0786

Affected Products

Alt Linux

Openssh

References · 359

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_enumusers.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/ssh_version.rb · Exploit
• 🔥 https://github.com/Rhynorater/CVE-2018-15473-Exploit · Exploit
• 🔥 https://github.com/zgzhang/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/xaitax/CVE-2024-6387_Check · Exploit
• 🔥 https://github.com/acrono/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/asterictnl-lvdw/CVE-2024-6387 · Exploit
• 🔥 https://github.com/cpandya2909/CVE-2020-15778 · Exploit
• 🔥 https://github.com/lflare/cve-2024-6387-poc · Exploit
• 🔥 https://github.com/epi052/cve-2018-15473 · Exploit
• 🔥 https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2016-6210 · Exploit
• 🔥 https://github.com/Christbowel/CVE-2023-25136 · Exploit
• 🔥 https://github.com/l0n3m4n/CVE-2024-6387 · Exploit
• 🔥 https://github.com/filipi86/CVE-2024-6387-Vulnerability-Checker · Exploit
• 🔥 https://github.com/vin01/poc-proxycommand-vulnerable · Exploit