3.5 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:openbsd:openssh:3.5:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2017-15906	732		2017-10-26	2020-08-24	5.0	None	Remote	Low	Not required	None	Partial	None
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
2	CVE-2012-0814	255	+Info	2012-01-27	2017-08-29	3.5	None	Remote	Medium	???	Partial	None	None
The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.
3	CVE-2011-5000	189	DoS	2012-04-05	2012-07-22	3.5	None	Remote	Medium	???	None	None	Partial
The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant.
4	CVE-2011-4327	200	+Info	2014-02-03	2014-02-21	2.1	None	Local	Low	Not required	Partial	None	None
ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.
5	CVE-2010-5107		DoS	2013-03-07	2017-09-19	5.0	None	Remote	Low	Not required	None	None	Partial
The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.
6	CVE-2010-4478	287	Bypass	2010-12-06	2017-09-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
7	CVE-2008-3259	200	+Info	2008-07-22	2017-08-08	1.2	None	Local	High	Not required	Partial	None	None
OpenSSH before 5.1 sets the SO_REUSEADDR socket option when the X11UseLocalhost configuration setting is disabled, which allows local users on some platforms to hijack the X11 forwarding port via a bind to a single IP address, as demonstrated on the HP-UX platform.
8	CVE-2007-2243	287		2007-04-25	2017-07-29	5.0	None	Remote	Low	Not required	Partial	None	None
OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
9	CVE-2006-5052			2006-09-27	2018-10-17	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
10	CVE-2006-5051	362	DoS Exec Code	2006-09-27	2017-10-11	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
11	CVE-2006-4924	399	DoS	2006-09-27	2018-10-17	7.8	None	Remote	Low	Not required	None	None	Complete
sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.
12	CVE-2006-0225		Exec Code	2006-01-25	2018-10-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
13	CVE-2005-2798			2005-09-06	2018-10-19	5.0	None	Remote	Low	Not required	Partial	None	None
sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
14	CVE-2005-2666	255		2005-08-23	2017-10-11	1.2	None	Local	High	Not required	Partial	None	None
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
15	CVE-2004-2760	16		2004-12-31	2009-01-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability.
16	CVE-2003-1562	362		2003-12-31	2008-09-05	7.6	None	Remote	High	Not required	Complete	Complete	Complete
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

Total number of vulnerabilities : 16 Page : 1 (This Page)