Summary
The host is running OpenSSH sshd with ChallengeResponseAuthentication enabled and is prone to buffer overflow vulnerability.
Impact
Successful exploitation could allows remote attackers to execute arbitrary code and gain escalated privileges.
Impact Level: Application
Solution
Upgrade to OpenSSH version 3.4 or later
For updates refer to http://www.openssh.com/
Insight
The flaw is due to an error in handling a large number of responses during challenge response authentication when using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
Affected
OpenSSH versions 2.3.1 to 3.3
References
Severity
Classification
-
CVE CVE-2002-0640 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Apple QuickTime Multiple Buffer Overflow Vulnerabilities (Windows)
- Adobe Reader '/Registry' and '/Ordering' Buffer Overflow Vulnerability (Win)
- Adobe Reader 'Plug-in' Buffer Overflow Vulnerability (Mac OS X)
- Attachmate Reflection FTP Client LIST Command Remote Heap Buffer Overflow Vulnerability
- Asterisk HTTP Manager Buffer Overflow Vulnerability