CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Openbsd » Openssh : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2000-0525 Exec Code 2000-06-08 2017-10-10
10.0
None Remote Low Not required Complete Complete Complete
OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon.
2 CVE-2000-0999 +Priv 2000-12-11 2008-09-05
10.0
None Remote Low Not required Complete Complete Complete
Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers to gain root privileges.
3 CVE-2001-0144 Exec Code Overflow 2001-03-12 2018-05-03
10.0
None Remote Low Not required Complete Complete Complete
CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.
4 CVE-2002-0083 189 +Priv 2002-03-15 2016-10-18
10.0
None Remote Low Not required Complete Complete Complete
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.
5 CVE-2002-0639 Exec Code Overflow 2002-07-03 2016-10-18
10.0
None Remote Low Not required Complete Complete Complete
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
6 CVE-2002-0640 Exec Code Overflow 2002-07-03 2016-10-18
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
7 CVE-2003-0693 Exec Code 2003-09-22 2018-05-03
10.0
None Remote Low Not required Complete Complete Complete
A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.
8 CVE-2003-0786 +Priv 2003-11-17 2008-09-10
10.0
None Remote Low Not required Complete Complete Complete
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
9 CVE-2006-5051 362 DoS Exec Code 2006-09-27 2017-10-11
9.3
None Remote Medium Not required Complete Complete Complete
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
10 CVE-2015-5600 264 DoS 2015-08-03 2018-09-11
8.5
None Remote Low Not required Partial None Complete
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
11 CVE-2006-4924 399 DoS 2006-09-27 2018-10-17
7.8
None Remote Low Not required None None Complete
sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.
12 CVE-2016-6515 20 DoS 2016-08-07 2021-09-14
7.8
None Remote Low Not required None None Complete
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
13 CVE-2016-8858 399 DoS 2016-12-09 2018-09-19
7.8
None Remote Low Not required None None Complete
** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."
14 CVE-2003-1562 362 2003-12-31 2008-09-05
7.6
None Remote High Not required Complete Complete Complete
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
15 CVE-2000-1169 2001-01-09 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent.
16 CVE-2001-0572 +Info 2001-08-22 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.
17 CVE-2001-0816 Bypass 2001-12-06 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands.
18 CVE-2001-1380 2001-10-18 2018-05-03
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses.
19 CVE-2001-1459 Exec Code Bypass 2001-06-19 2017-07-11
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d.
20 CVE-2001-1507 2001-12-31 2008-09-10
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged.
21 CVE-2002-0575 Overflow +Priv 2002-06-18 2016-10-18
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges.
22 CVE-2002-0765 2002-08-12 2008-09-10
7.5
None Remote Low Not required Partial Partial Partial
sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.
23 CVE-2003-0386 Bypass 2003-07-02 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "[email protected]" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.
24 CVE-2003-0682 2003-10-06 2018-05-03
7.5
None Remote Low Not required Partial Partial Partial
"Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695.
25 CVE-2003-0695 DoS Exec Code 2003-10-06 2018-05-03
7.5
None Remote Low Not required Partial Partial Partial
Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693.
26 CVE-2003-0787 +Priv 2003-11-17 2008-09-10
7.5
None Remote Low Not required Partial Partial Partial
The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.
27 CVE-2006-5794 Bypass 2006-11-08 2018-10-17
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
28 CVE-2007-4752 20 +Priv 2007-09-12 2018-10-15
7.5
None Remote Low Not required Partial Partial Partial
ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
29 CVE-2010-4478 287 Bypass 2010-12-06 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
30 CVE-2014-1692 119 DoS Overflow Mem. Corr. 2014-01-29 2020-02-04
7.5
None Remote Low Not required Partial Partial Partial
The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.
31 CVE-2016-1908 254 2017-04-11 2018-09-11
7.5
None Remote Low Not required Partial Partial Partial
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.
32 CVE-2016-10009 426 2017-01-05 2018-09-11
7.5
None Remote Low Not required Partial Partial Partial
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
33 CVE-2001-0529 2001-08-14 2017-10-10
7.2
None Local Low Not required Complete Complete Complete
OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack.
34 CVE-2001-0872 +Priv 2001-12-21 2018-05-03
7.2
None Local Low Not required Complete Complete Complete
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges.
35 CVE-2015-6565 264 DoS 2015-08-24 2017-09-02
7.2
None Local Low Not required Complete Complete Complete
sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence.
36 CVE-2015-8325 264 +Priv 2016-05-01 2018-06-30
7.2
None Local Low Not required Complete Complete Complete
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
37 CVE-2016-10012 119 Overflow +Priv 2017-01-05 2018-09-11
7.2
None Local Low Not required Complete Complete Complete
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.
38 CVE-2008-1483 264 2008-03-24 2018-10-11
6.9
None Local Medium Not required Complete Complete Complete
OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
39 CVE-2015-6564 264 +Priv 2015-08-24 2019-03-26
6.9
None Local Medium Not required Complete Complete Complete
Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
40 CVE-2016-10010 264 +Priv 2017-01-05 2018-06-01
6.9
None Local Medium Not required Complete Complete Complete
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
41 CVE-2001-1585 287 Bypass 2001-12-31 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to bypass authentication as other users by supplying a public key from that user's authorized_keys file.
42 CVE-2004-2760 16 2004-12-31 2009-01-29
6.8
None Remote Medium Not required Partial Partial Partial
sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability.
43 CVE-2020-15778 78 2020-07-24 2021-06-22
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
44 CVE-2008-1657 264 Bypass 2008-04-02 2018-10-11
6.5
None Remote Low ??? Partial Partial Partial
OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
45 CVE-2004-1653 2004-08-31 2017-07-11
6.4
None Remote Low Not required Partial Partial None
The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS.
46 CVE-2013-4548 264 Bypass 2013-11-08 2019-10-09
6.0
None Remote Medium ??? Partial Partial Partial
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.
47 CVE-2014-2532 264 Bypass 2014-03-18 2018-07-19
5.8
None Remote Medium Not required Partial Partial None
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
48 CVE-2014-2653 20 2014-03-27 2017-01-07
5.8
None Remote Medium Not required Partial Partial None
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
49 CVE-2019-6111 22 Dir. Trav. 2019-01-31 2020-08-24
5.8
None Remote Medium Not required None Partial Partial
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
50 CVE-2016-3115 Bypass 2016-03-22 2018-09-11
5.5
None Remote Low ??? Partial Partial None
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
Total number of vulnerabilities : 98   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.