CVE-2002-1357 Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute ar...
HighCVSS 10.0
EPSS 9.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco ios | = 12.0s | No fix listed |
| cisco ios | = 12.0st | No fix listed |
| cisco ios | = 12.1e | No fix listed |
| cisco ios | = 12.1ea | No fix listed |
| cisco ios | = 12.1t | No fix listed |
| cisco ios | = 12.2 | No fix listed |
| cisco ios | = 12.2s | No fix listed |
| cisco ios | = 12.2t | No fix listed |
| fissh ssh client | = 1.0a_for_windows | No fix listed |
| intersoft securenetterm | = 5.4.1 | No fix listed |
| netcomposite shellguard ssh | = 3.4.6 | No fix listed |
| pragma systems secureshell | = 2.0 | No fix listed |
| putty | = 0.48 | No fix listed |
| putty | = 0.49 | No fix listed |
| putty | = 0.53 | No fix listed |
| winscp | = 2.0.0 | No fix listed |
References
- 20021216 R7-0009: Vulnerabilities in SSH2 Implementations from Multiple Vendors mailing-list
- 1005812 vdb-entry
- 1005813 vdb-entry
- CA-2002-36 third-party-advisory us-government-resource
- VU#389665 third-party-advisory us-government-resource
- 6405 vdb-entry
- ssh-transport-length-bo(10868) vdb-entry
- oval:org.mitre.oval:def:5849 signature vdb-entry
- Debian Security Tracker CVE-2002-1357 vendor-advisory