CVE-2001-0572: High severity OpenBSD OpenSSH vulnerability
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorizedkeys in RSA authentication, or (4) the lengths of shell commands.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2001-0572?
CVE-2001-0572 is considered a medium severity vulnerability due to its potential for password information leakage.
How do I fix CVE-2001-0572?
To fix CVE-2001-0572, upgrade to a secure version of OpenSSH or SSH that addresses the identified weaknesses.
Which versions of OpenSSH are affected by CVE-2001-0572?
OpenSSH versions prior to 4.5 are affected by CVE-2001-0572.
Can CVE-2001-0572 be exploited remotely?
Yes, CVE-2001-0572 can be exploited remotely by an attacker to obtain sensitive information.
What types of information can be leaked due to CVE-2001-0572?
CVE-2001-0572 can leak password lengths and whether RSA keys are used, aiding brute force attacks.