CVE-2001-1382: Medium severity OpenBSD OpenSSH vulnerability
Published Sep 27, 2001
·Updated
The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used.
Affected Software
1 affected component
OpenBSD OpenSSH<=2.9.9p2
Event History
Sep 27, 2001
CVE Published
04:00 AM
Apr 2, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1382?
CVE-2001-1382 has a medium severity level due to its potential to allow remote attackers to exploit echo packet behavior.
2
How do I fix CVE-2001-1382?
To fix CVE-2001-1382, upgrade OpenSSH to version 2.9.9p3 or later.
3
What does CVE-2001-1382 exploit in OpenSSH?
CVE-2001-1382 exploits the 'echo simulation' traffic analysis countermeasure, potentially revealing information about its usage.
4
Is CVE-2001-1382 present in the latest OpenSSH versions?
No, CVE-2001-1382 is not present in OpenSSH versions later than 2.9.9p2.
5
Who is affected by CVE-2001-1382?
Users running OpenSSH versions prior to 2.9.9p3 are affected by CVE-2001-1382.