Vulnerability CVE-2002-0639 - CERT Civis.Net

Vulnerability Name:

CVE-2002-0639 (CCN-9169)

Assigned:

2002-06-26

Published:

2002-06-26

Updated:

2016-10-18

Summary:

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CALDERA
Type: UNKNOWN
CSSA-2002-030.0

Source: CCN
Type: Caldera International, Inc. Security Advisory CSSA-2002-030.0
OpenSSH Vulnerabilities in Challenge Response Handling

Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-02:31
openssh contains remote vulnerability

Source: CCN
Type: FreeBSD Security Notice FreeBSD-SN-02:05
security issues in ports

Source: CCN
Type: BugTraq Mailing List, Mon Jun 24 2002 - 16:00:10 CDT
Upcoming OpenSSH vulnerability

Source: BUGTRAQ
Type: UNKNOWN
20020626 [OpenPKG-SA-2002.005] OpenPKG Security Advisory (openssh)

Source: CCN
Type: NetBSD Security Advisory 2002-005
OpenSSH protocol version 2 challenge-response authentication vulnerability

Source: CCN
Type: BugTraq Mailing List, Fri Jun 28 2002 - 16:12:47 CDT
Sun statement on the OpenSSH Remote Challenge Vulnerability

Source: CCN
Type: Internet Security Systems Security Advisory, June 26, 2002
OpenSSH Remote Challenge Vulnerability

Source: MITRE
Type: CNA
CVE-2002-0639

Source: CONECTIVA
Type: UNKNOWN
CLA-2002:502

Source: CCN
Type: Conectiva Linux Announcement CLSA-2002:500
Remote vulnerability in OpenSSH

Source: CCN
Type: Conectiva Linux Announcement CLSA-2001:502
Remote vulnerability in openssh

Source: BUGTRAQ
Type: UNKNOWN
20020626 OpenSSH Security Advisory (adv.iss)

Source: BUGTRAQ
Type: UNKNOWN
20020626 Revised OpenSSH Security Advisory (adv.iss)

Source: BUGTRAQ
Type: UNKNOWN
20020627 How to reproduce OpenSSH Overflow.

Source: CCN
Type: RHSA-2002-127
Updated OpenSSH packages fix various security issues

Source: CCN
Type: RHSA-2002-131
openssh security update

Source: CCN
Type: Sun Alert ID: 45508
OpenSSH-2.9p2-12C4 May Allow root Exploit in Sun Cobalt RaQ 550

Source: CCN
Type: Sun Alert ID: 45525
Secure Shell ("ssh") Integer Overflow can Cause a Remote Security Exploit in Solaris 9

Source: CCN
Type: CERT Advisory CA-2002-18
OpenSSH Vulnerabilities in Challenge Response Handling

Source: CERT
Type: US Government Resource
CA-2002-18

Source: CCN
Type: CIAC Information Bulletin M-095
OpenSSH Challenge Response Vulnerabilities

Source: DEBIAN
Type: UNKNOWN
DSA-134

Source: DEBIAN
Type: DSA-134
ssh -- remote exploit

Source: CCN
Type: Global InterSec LLC Security Advisory 2002062801
OpenSSH kbd-interactive buffer overflow

Source: XF
Type: UNKNOWN
openssh-challenge-response-bo(9169)

Source: CCN
Type: US-CERT VU#369347
OpenSSH vulnerabilities in challenge response handling

Source: CERT-VN
Type: US Government Resource
VU#369347

Source: ENGARDE
Type: UNKNOWN
ESA-20020702-016

Source: CCN
Type: EnGarde Secure Linux Security Advisory ESA-20020625-015
openssh

Source: CCN
Type: Immunix OS Security Advisory 25-June-2002
Immunix: 'OpenSSH' Remote Vulnerability

Source: CCN
Type: EnGarde Secure Linux Security Advisory ESA-20020702-016
several vulnerabilities in the OpenSSH daemon.

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2002:040

Source: CCN
Type: OpenBSD Web site
OpenBSD

Source: CCN
Type: OpenPKG-SA-2002.005
OpenSSH

Source: CCN
Type: OpenSSH Web site
OpenSSH

Source: CCN
Type: OpenSSH Security Advisory
adv.iss

Source: OSVDB
Type: UNKNOWN
6245

Source: CCN
Type: OSVDB ID: 6245
OpenSSH SKEY/BSD_AUTH Challenge-Response Remote Overflow

Source: BID
Type: UNKNOWN
5093

Source: CCN
Type: BID-5093
OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

Source: CCN
Type: Trustix Secure Linux Security Advisory #2002-0059
openssh

Source: HP
Type: UNKNOWN
HPSBUX0206-195

Source: XF
Type: UNKNOWN
openssh-challenge-response-bo(9169)

Source: MISC
Type: UNKNOWN
https://twitter.com/RooneyMcNibNug/status/1152332585349111810

Source: ISS
Type: UNKNOWN
20020626 OpenSSH Remote Challenge Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:openbsd:openssh:1.2.2:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:1.2.3:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.1.1:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.2:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.3:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.5:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.5.1:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.5.2:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.9:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.9.9:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.9p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:2.9p2:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.1:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.1p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.2:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.2p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.1:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.1p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2.2p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2.3p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.3:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.3p1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:openbsd:openssh:3.0:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2.2:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2.2p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.1p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.1:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.2p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.0.2:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.1p1:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.1:-:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2:*:*:*:*:*:*:*

OR cpe:/a:openbsd:openssh:3.2.3p1:*:*:*:*:*:*:*

AND

cpe:/o:suse:suse_linux:6.4:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*

OR cpe:/o:freebsd:ports_collection:*:*:*:*:*:*:*:*

OR cpe:/o:trustix:secure_linux:1.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:6.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:1.0.1:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:7.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*

OR cpe:/o:trustix:secure_linux:1.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*

OR cpe:/a:mandrakesoft:mandrake_single_network_firewall:7.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:7.2:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:trustix:secure_linux:1.5:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:8.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:7.3:*:*:*:*:*:*:*

OR cpe:/o:openbsd:openbsd:3.0:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.5.2:*:*:*:*:*:*:*

OR cpe:/o:engardelinux:secure_linux:-:*:*:*:*:*:*:*

OR cpe:/a:suse:suse_linux_firewall:*:*:*:*:*:*:*:*

OR cpe:/a:suse:suse_linux_database_server:*:*:*:*:*:*:*:*

OR cpe:/a:suse:suse_email_server:iii:*:*:*:*:*:*:*

OR cpe:/a:openpkg:openpkg:1.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:8.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:openbsd:openbsd:3.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*

OR cpe:/o:sun:sunos:5.9:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*

OR cpe:/o:netbsd:netbsd:1.6:beta:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*

OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:pseries:*

OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:iseries:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.debian:def:134	V	remote exploit	2002-06-24