CVE-2001-1470: Medium severity SSH ssh vulnerability
Published Jan 18, 2001
·Updated
The IDEA cipher as implemented by SSH1 does not protect the final block of a message against modification, which allows remote attackers to modify the block without detection by changing its cyclic redundancy check (CRC) to match the modifications to the message.
Affected Software
8 affected components
SSH ssh=1.2.31
SSH ssh=1.2.24
SSH ssh=1.2.25
SSH ssh=1.2.30
SSH ssh=1.2.26
SSH ssh=1.2.27
SSH ssh=1.2.28
SSH ssh=1.2.29
Event History
Jan 18, 2001
CVE Published
05:00 AM
Apr 21, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1470?
CVE-2001-1470 is considered a moderate severity vulnerability due to its potential to allow undetected message modification.
2
How do I fix CVE-2001-1470?
To fix CVE-2001-1470, upgrade to a secure version of SSH that does not use the vulnerable IDEA cipher.
3
Which versions of SSH are affected by CVE-2001-1470?
CVE-2001-1470 affects SSH versions 1.2.24 through 1.2.31.
4
What type of attack does CVE-2001-1470 facilitate?
CVE-2001-1470 facilitates remote attackers to modify the final block of a message undetected.
5
Is encryption affected by CVE-2001-1470?
Yes, the IDEA cipher implementation in SSH1 is affected, undermining the integrity of encrypted messages.