CVE-2002-1360 Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denia...
HighCVSS 10.0
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco ios | = 12.0s | No fix listed |
| cisco ios | = 12.0st | No fix listed |
| cisco ios | = 12.1e | No fix listed |
| cisco ios | = 12.1ea | No fix listed |
| cisco ios | = 12.1t | No fix listed |
| cisco ios | = 12.2 | No fix listed |
| cisco ios | = 12.2s | No fix listed |
| cisco ios | = 12.2t | No fix listed |
| fissh ssh client | = 1.0a_for_windows | No fix listed |
| intersoft securenetterm | = 5.4.1 | No fix listed |
| netcomposite shellguard ssh | = 3.4.6 | No fix listed |
| pragma systems secureshell | = 2.0 | No fix listed |
| putty | = 0.48 | No fix listed |
| putty | = 0.49 | No fix listed |
| putty | = 0.53 | No fix listed |
| winscp | = 2.0.0 | No fix listed |
References
- 20021216 R7-0009: Vulnerabilities in SSH2 Implementations from Multiple Vendors mailing-list vendor-advisory
- 1005812 vdb-entry
- 1005813 vdb-entry
- CA-2002-36 third-party-advisory us-government-resource
- oval:org.mitre.oval:def:5797 signature vdb-entry
- Debian Security Tracker CVE-2002-1360 vendor-advisory