Details of VAR-200203-0011

ID

VAR-200203-0011

CVE

CVE-2002-0083

TITLE

OpenSSH contains a one-off overflow of an array in the channel handling code

Trust: 0.8

sources: CERT/CC: VU#408419

DESCRIPTION

Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. OpenSSH is a program used to provide secure connection and communications between client and servers. Channels are used to segregate differing traffic between the client and the server. OpenSSH is a suite implementing the SSH protocol. It includes client and server software, and supports ssh and sftp. It was initially developed for BSD, but is also widely used for Linux, Solaris, and other UNIX-like operating systems. A vulnerability has been announced in some versions of OpenSSH. A malicious client may exploit this vulnerability by connecting to a vulnerable server. Valid credentials are believed to be required, since the exploitable condition reportedly occurs after successful authentication. An examination of the code suggests this, but it has not been confirmed by the maintainer. Administrators should assume that this can be exploited without authentication and should patch vulnerable versions immediately. It encrypts and transmits all network communications, thereby avoiding attacks at many network layers, and is a very useful network connection tool. A user with a legal login account can use this vulnerability to obtain the root authority of the host. To implement X11, TCP and proxy forwarding, OpenSSH multiplexes multiple "channels" on a single TCP connection. The program may mistakenly use memory data outside the normal range, and an attacker with a legitimate login account logs in After entering the system, this vulnerability can be exploited to allow sshd to execute arbitrary commands with root privileges

Trust: 2.7

sources: NVD: CVE-2002-0083 // CERT/CC: VU#408419 // JVNDB: JVNDB-2002-000054 // BID: 4241 // VULHUB: VHN-4478

AFFECTED PRODUCTS

vendor:	redhat	model:	linux	scope:	eq	version:	7.1	Trust: 1.6
vendor:	conectiva	model:	linux	scope:	eq	version:	ecommerce	Trust: 1.0
vendor:	openbsd	model:	openssh	scope:	gte	version:	2.0	Trust: 1.0
vendor:	conectiva	model:	linux	scope:	eq	version:	5.1	Trust: 1.0
vendor:	redhat	model:	linux	scope:	eq	version:	7.2	Trust: 1.0
vendor:	mandrakesoft	model:	mandrake linux	scope:	eq	version:	7.2	Trust: 1.0
vendor:	immunix	model:	immunix	scope:	eq	version:	7.0	Trust: 1.0
vendor:	mandrakesoft	model:	mandrake linux	scope:	eq	version:	8.0	Trust: 1.0
vendor:	suse	model:	linux	scope:	eq	version:	7.2	Trust: 1.0
vendor:	trustix	model:	secure linux	scope:	eq	version:	1.2	Trust: 1.0
vendor:	conectiva	model:	linux	scope:	eq	version:	7.0	Trust: 1.0
vendor:	trustix	model:	secure linux	scope:	eq	version:	1.1	Trust: 1.0
vendor:	mandrakesoft	model:	mandrake linux corporate server	scope:	eq	version:	1.0.1	Trust: 1.0
vendor:	openpkg	model:	openpkg	scope:	eq	version:	1.0	Trust: 1.0
vendor:	mandrakesoft	model:	mandrake linux	scope:	eq	version:	7.1	Trust: 1.0
vendor:	conectiva	model:	linux	scope:	eq	version:	5.0	Trust: 1.0
vendor:	engardelinux	model:	secure linux	scope:	eq	version:	1.0.1	Trust: 1.0
vendor:	conectiva	model:	linux	scope:	eq	version:	6.0	Trust: 1.0
vendor:	mandrakesoft	model:	mandrake linux	scope:	eq	version:	8.1	Trust: 1.0
vendor:	openbsd	model:	openssh	scope:	lt	version:	3.1	Trust: 1.0
vendor:	trustix	model:	secure linux	scope:	eq	version:	1.5	Trust: 1.0
vendor:	mandrakesoft	model:	mandrake single network firewall	scope:	eq	version:	7.2	Trust: 1.0
vendor:	redhat	model:	linux	scope:	eq	version:	7.0	Trust: 1.0
vendor:	conectiva	model:	linux	scope:	eq	version:	graficas	Trust: 1.0
vendor:	suse	model:	linux	scope:	eq	version:	7.1	Trust: 1.0
vendor:	suse	model:	linux	scope:	eq	version:	7.3	Trust: 1.0
vendor:	suse	model:	linux	scope:	eq	version:	6.4	Trust: 1.0
vendor:	suse	model:	linux	scope:	eq	version:	7.0	Trust: 1.0
vendor:	apple	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	bsdi	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	caldera	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	conectiva	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	engarde	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	hewlett packard	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	mandrakesoft	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	netbsd	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	openbsd	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	openpkg	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	openssh	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	openwall gnu linux	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	red hat	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	sco	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	suse	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	sun	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	trustix	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	ヒューレットパッカード	model:	hp-ux	scope:	-	version:	-	Trust: 0.8
vendor:	レッドハット	model:	red hat linux	scope:	eq	version:	7.0	Trust: 0.8
vendor:	レッドハット	model:	red hat linux	scope:	eq	version:	7.2	Trust: 0.8
vendor:	レッドハット	model:	red hat linux	scope:	eq	version:	7.1	Trust: 0.8
vendor:	openbsd	model:	openssh	scope:	-	version:	-	Trust: 0.8
vendor:	openssh	model:	p1	scope:	eq	version:	3.0.2	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	3.0.2	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	3.0.1	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.9.9	Trust: 0.3
vendor:	openssh	model:	p2	scope:	eq	version:	2.9	Trust: 0.3
vendor:	openssh	model:	p1	scope:	eq	version:	2.9	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.9	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.5.2	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.5.1	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.5	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.3	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.2	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.1.1	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	eq	version:	2.1	Trust: 0.3
vendor:	openbsd	model:	openbsd	scope:	eq	version:	2.8	Trust: 0.3
vendor:	openssh	model:	openssh	scope:	ne	version:	3.1	Trust: 0.3

sources: CERT/CC: VU#408419 // BID: 4241 // JVNDB: JVNDB-2002-000054 // CNNVD: CNNVD-200203-034 // NVD: CVE-2002-0083

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2002-0083
value:	CRITICAL
Trust: 1.0
CARNEGIE MELLON:	VU#408419
value:	25.65
Trust: 0.8
NVD:	CVE-2002-0083
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-200203-034
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-4478
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2002-0083
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-4478
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2002-0083
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2002-0083
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CERT/CC: VU#408419 // VULHUB: VHN-4478 // JVNDB: JVNDB-2002-000054 // CNNVD: CNNVD-200203-034 // NVD: CVE-2002-0083

PROBLEMTYPE DATA

problemtype:	CWE-193	Trust: 1.0
problemtype:	Determination of boundary conditions (CWE-193) [NVD evaluation ]	Trust: 0.8
problemtype:	CWE-189	Trust: 0.1

sources: VULHUB: VHN-4478 // JVNDB: JVNDB-2002-000054 // NVD: CVE-2002-0083

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200203-034

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-200203-034

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-4478

PATCH

title:

043

url:

http://www.openbsd.org/

Trust: 0.8

sources: JVNDB: JVNDB-2002-000054

EXTERNAL IDS

db:	NVD	id:	CVE-2002-0083	Trust: 3.6
db:	BID	id:	4241	Trust: 3.0
db:	CERT/CC	id:	VU#408419	Trust: 1.6
db:	OSVDB	id:	730	Trust: 1.1
db:	JVNDB	id:	JVNDB-2002-000054	Trust: 0.8
db:	CNNVD	id:	CNNVD-200203-034	Trust: 0.7
db:	EXPLOIT-DB	id:	21314	Trust: 0.1
db:	SEEBUG	id:	SSVID-75148	Trust: 0.1
db:	VULHUB	id:	VHN-4478	Trust: 0.1

sources: CERT/CC: VU#408419 // VULHUB: VHN-4478 // BID: 4241 // JVNDB: JVNDB-2002-000054 // CNNVD: CNNVD-200203-034 // NVD: CVE-2002-0083

REFERENCES

url:	http://www.openbsd.org/advisories/ssh_channelalloc.txt	Trust: 1.9
url:	http://www.securityfocus.com/bid/4241	Trust: 1.9
url:	http://marc.info/?l=bugtraq&m=101553908201861&w=2	Trust: 1.1
url:	http://marc.info/?l=bugtraq&m=101552065005254&w=2	Trust: 1.1
url:	http://marc.info/?l=bugtraq&m=101561384821761&w=2	Trust: 1.1
url:	http://marc.info/?l=bugtraq&m=101586991827622&w=2	Trust: 1.1
url:	http://archives.neohapsis.com/archives/bugtraq/2002-03/0108.html	Trust: 1.1
url:	http://online.securityfocus.com/archive/1/264657	Trust: 1.1
url:	http://www.calderasystems.com/support/security/advisories/cssa-2002-012.0.txt	Trust: 1.1
url:	ftp://stage.caldera.com/pub/security/openserver/cssa-2002-sco.10/cssa-2002-sco.10.txt	Trust: 1.1
url:	ftp://stage.caldera.com/pub/security/openunix/cssa-2002-sco.11/cssa-2002-sco.11.txt	Trust: 1.1
url:	http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000467	Trust: 1.1
url:	http://www.debian.org/security/2002/dsa-119	Trust: 1.1
url:	http://www.linuxsecurity.com/advisories/other_advisory-1937.html	Trust: 1.1
url:	ftp://ftp.freebsd.org/pub/freebsd/cert/advisories/freebsd-sa-02:13.openssh.asc	Trust: 1.1
url:	http://online.securityfocus.com/advisories/3960	Trust: 1.1
url:	http://www.linux-mandrake.com/en/security/2002/mdksa-2002-019.php	Trust: 1.1
url:	ftp://ftp.netbsd.org/pub/netbsd/security/advisories/netbsd-sa2002-004.txt.asc	Trust: 1.1
url:	http://www.osvdb.org/730	Trust: 1.1
url:	http://www.redhat.com/support/errata/rhsa-2002-043.html	Trust: 1.1
url:	http://www.novell.com/linux/security/advisories/2002_009_openssh_txt.html	Trust: 1.1
url:	http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0060.html	Trust: 1.1
url:	http://www.iss.net/security_center/static/8383.php	Trust: 1.1
url:	http://www.pine.nl/advisories/pine-cert-20020301.txt	Trust: 0.8
url:	http://online.securityfocus.com/bid/4241	Trust: 0.8
url:	http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-0083	Trust: 0.8
url:	http://www.kb.cert.org/vuls/id/408419	Trust: 0.8
url:	http://support.coresecurity.com/impact/exploits/44711fd6971e717073942524961d8e3e.html	Trust: 0.3

sources: CERT/CC: VU#408419 // VULHUB: VHN-4478 // BID: 4241 // JVNDB: JVNDB-2002-000054 // NVD: CVE-2002-0083

CREDITS

Joost Pol※ joost@pine.nl

Trust: 0.6

sources: CNNVD: CNNVD-200203-034

SOURCES

db:	CERT/CC	id:	VU#408419
db:	VULHUB	id:	VHN-4478
db:	BID	id:	4241
db:	JVNDB	id:	JVNDB-2002-000054
db:	CNNVD	id:	CNNVD-200203-034
db:	NVD	id:	CVE-2002-0083

LAST UPDATE DATE

2024-08-14T15:09:58.648000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#408419	date:	2002-04-02T00:00:00
db:	VULHUB	id:	VHN-4478	date:	2016-10-18T00:00:00
db:	BID	id:	4241	date:	2007-11-05T15:25:00
db:	JVNDB	id:	JVNDB-2002-000054	date:	2024-02-26T07:51:00
db:	CNNVD	id:	CNNVD-200203-034	date:	2006-09-15T00:00:00
db:	NVD	id:	CVE-2002-0083	date:	2024-02-02T02:52:51.803

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#408419	date:	2002-03-07T00:00:00
db:	VULHUB	id:	VHN-4478	date:	2002-03-15T00:00:00
db:	BID	id:	4241	date:	2002-03-07T00:00:00
db:	JVNDB	id:	JVNDB-2002-000054	date:	2007-04-01T00:00:00
db:	CNNVD	id:	CNNVD-200203-034	date:	2002-03-15T00:00:00
db:	NVD	id:	CVE-2002-0083	date:	2002-03-15T05:00:00