CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Openbsd : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-2168 189 Overflow 2011-05-24 2011-06-10
5.0
 None Remote Low Not required None None Partial
Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418.
2 CVE-2009-0780 DoS 2009-03-04 2010-04-27
5.0
 None Remote Low Not required None None Partial
The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.
3 CVE-2008-4109 264 DoS 2008-09-18 2009-02-12
5.0
 None Remote Low Not required None None Partial
A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service (connection slot exhaustion) via multiple login attempts. NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.
4 CVE-2007-4654 399 DoS Overflow 2007-09-04 2008-11-15
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in SSHield 1.6.1 with OpenSSH 3.0.2p1 on Cisco WebNS 8.20.0.1 on Cisco Content Services Switch (CSS) series 11000 devices allows remote attackers to cause a denial of service (connection slot exhaustion and device crash) via a series of large packets designed to exploit the SSH CRC32 attack detection overflow (CVE-2001-0144), possibly a related issue to CVE-2002-1024.
5 CVE-2007-2243 287 2007-04-25 2008-09-05
5.0
 None Remote Low Not required Partial None None
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
6 CVE-2007-0343 DoS 2007-01-17 2008-09-05
5.0
 None Remote Low Not required None None Partial
OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets.
7 CVE-2006-5052 2006-09-27 2010-08-21
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
8 CVE-2006-4925 DoS 2006-09-28 2010-09-15
5.0
 None Remote Low Not required None None Partial
packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL.
9 CVE-2006-4436 Bypass 2006-08-28 2008-09-05
5.0
 None Remote Low Not required Partial None None
isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.
10 CVE-2006-0883 399 DoS 2006-03-06 2011-08-26
5.0
 None Remote Low Not required None None Partial
OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting.
11 CVE-2005-2798 2005-09-06 2010-08-21
5.0
 None Remote Low Not required Partial None None
sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
12 CVE-2005-2797 2005-09-06 2008-09-05
5.0
 None Remote Low Not required None Partial None
OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.
13 CVE-2005-0960 DoS 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None None Partial
Multiple vulnerabilities in the SACK functionality in (1) tcp_input.c and (2) tcp_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cause a denial of service (memory exhaustion or system crash).
14 CVE-2005-0740 DoS 2005-01-13 2008-09-05
5.0
 None Remote Low Not required None None Partial
The TCP stack (tcp_input.c) in OpenBSD 3.5 and 3.6 allows remote attackers to cause a denial of service (system panic) via crafted values in the TCP timestamp option, which causes invalid arguments to be used when calculating the retransmit timeout.
15 CVE-2005-0637 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None Partial None
The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory.
16 CVE-2005-0356 DoS 2005-05-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.
17 CVE-2004-2069 DoS 2004-12-31 2010-08-21
5.0
 None Remote Low Not required None None Partial
sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption).
18 CVE-2004-0819 DoS 2004-08-25 2008-09-05
5.0
 None Remote Low Not required None None Partial
The bridge functionality in OpenBSD 3.4 and 3.5, when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled, allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet.
19 CVE-2004-0417 Overflow 2004-08-06 2010-08-21
5.0
 None Remote Low Not required None None Partial
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
20 CVE-2004-0257 DoS 2004-11-23 2008-09-05
5.0
 None Remote Low Not required None None Partial
OpenBSD 3.4 and NetBSD 1.6 and 1.6.1 allow remote attackers to cause a denial of service (crash) by sending an IPv6 packet with a small MTU to a listening port and then issuing a TCP connect to that port.
21 CVE-2004-0222 DoS 2004-05-04 2008-09-05
5.0
 None Remote Low Not required None None Partial
Multiple memory leaks in isakmpd in OpenBSD 3.4 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via certain ISAKMP packets, as demonstrated by the Striker ISAKMP Protocol Test Suite.
22 CVE-2004-0221 DoS 2004-05-04 2008-09-05
5.0
 None Remote Low Not required None None Partial
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite.
23 CVE-2004-0219 DoS 2004-05-04 2008-09-10
5.0
 None Remote Low Not required None None Partial
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
24 CVE-2004-0218 DoS 2004-05-04 2008-09-05
5.0
 None Remote Low Not required None None Partial
isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite.
25 CVE-2004-0171 DoS 2004-03-15 2008-09-05
5.0
 None Remote Low Not required None None Partial
FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets, which prevents the operating system from creating new connections.
26 CVE-2004-0112 DoS 2004-11-23 2010-08-21
5.0
 None Remote Low Not required None None Partial
The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read.
27 CVE-2004-0081 DoS 2004-11-23 2010-08-21
5.0
 None Remote Low Not required None None Partial
OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.
28 CVE-2004-0079 DoS 2004-11-23 2010-08-21
5.0
 None Remote Low Not required None None Partial
The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.
29 CVE-2003-0804 DoS 2003-11-17 2008-09-10
5.0
 None Remote Low Not required None None Partial
The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.
30 CVE-2003-0688 DoS 2003-10-20 2008-09-10
5.0
 None Remote Low Not required None None Partial
The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.
31 CVE-2003-0190 2003-05-12 2008-09-10
5.0
 None Remote Low Not required Partial None None
OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.
32 CVE-2003-0078 +Info 2003-03-03 2008-09-10
5.0
 None Remote Low Not required Partial None None
ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."
33 CVE-2002-2222 DoS 2002-12-31 2008-09-05
5.1
 User Remote High Not required Partial Partial Partial
isakmpd/message.c in isakmpd in FreeBSD before isakmpd-20020403_1, and in OpenBSD 3.1, allows remote attackers to cause a denial of service (crash) by sending Internet Key Exchange (IKE) payloads out of sequence.
34 CVE-2002-1345 Dir. Trav. 2002-12-23 2008-09-10
5.0
 None Remote Low Not required None Partial None
Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.
35 CVE-2002-1221 DoS 2002-11-29 2008-09-10
5.0
 None Remote Low Not required None None Partial
BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference.
36 CVE-2002-1220 DoS 2002-11-29 2008-09-10
5.0
 None Remote Low Not required None None Partial
BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size.
37 CVE-2002-0514 2002-08-12 2008-09-05
5.0
 None Remote Low Not required Partial None None
PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL.
38 CVE-2002-0381 Bypass 2002-06-25 2008-09-05
5.0
 None Remote Low Not required Partial None None
The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address.
39 CVE-2001-1382 2001-09-27 2008-09-05
5.0
 None Remote Low Not required Partial None None
The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used.
40 CVE-2001-1244 DoS 2001-07-07 2008-09-05
5.0
 None Remote Low Not required None None Partial
Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process.
41 CVE-2000-0992 Dir. Trav. 2000-12-19 2008-09-05
5.0
 None Remote Low Not required None Partial None
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.
42 CVE-2000-0962 DoS 2000-12-19 2008-09-05
5.0
 None Remote Low Not required None None Partial
The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service.
43 CVE-2000-0914 DoS 2000-12-19 2008-09-05
5.0
 None Remote Low Not required None None Partial
OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests.
44 CVE-2000-0574 DoS Exec Code 2000-07-07 2008-09-10
5.0
 None Remote Low Not required None None Partial
FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands.
45 CVE-2000-0310 DoS 2001-03-12 2008-09-10
5.0
 None Remote Low Not required None None Partial
IP fragment assembly in OpenBSD 2.4 allows a remote attacker to cause a denial of service by sending a large number of fragmented packets.
46 CVE-2000-0217 2000-02-24 2008-09-10
5.1
 User Remote High Not required Partial Partial Partial
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.
47 CVE-1999-1225 1997-08-24 2008-09-10
5.0
 None Remote Low Not required Partial None None
rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not.
48 CVE-1999-0727 1999-08-06 2008-09-09
5.0
 None Remote Low Not required Partial None None
A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted.
49 CVE-1999-0482 1999-03-21 2008-09-09
5.0
 None Remote Low Not required None None Partial
OpenBSD kernel crash through TSS handling, as caused by the crashme program.
50 CVE-1999-0481 DoS 1999-03-22 2008-09-09
5.0
 None Remote Low Not required None None Partial
Denial of service in "poll" in OpenBSD.
Total number of vulnerabilities : 54   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.