CVE-2002-1644 SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the pare...
HighCVSS 7.2
EPSS 0.45%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ssh2 | = 2.0.13 | No fix listed |
| ssh2 | = 2.1 | No fix listed |
| ssh2 | = 2.2 | No fix listed |
| ssh2 | = 2.3 | No fix listed |
| ssh2 | = 2.4 | No fix listed |
| ssh2 | = 2.5 | No fix listed |
| ssh2 | = 3.0 | No fix listed |
| ssh2 | = 3.0.1 | No fix listed |
| ssh2 | = 3.1 | No fix listed |
| ssh2 | = 3.1.1 | No fix listed |
| ssh2 | = 3.1.2 | No fix listed |
| ssh2 | = 3.1.3 | No fix listed |
| ssh2 | = 3.1.4 | No fix listed |
| ssh2 | = 3.2 | No fix listed |
| ssh2 | = 3.2.1 | No fix listed |
References
- VU#740619 patch third-party-advisory us-government-resource
- 6247 patch vdb-entry
- www.ssh.com patch
- ssh-setsid-privilege-elevation(10710) vdb-entry