CVE-2001-1473: High severity SSH ssh vulnerability
The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2001-1473?
CVE-2001-1473 is considered a high-severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2001-1473?
To fix CVE-2001-1473, upgrade to a version of SSH that is not affected, specifically versions later than 1.2.31.
What impact does CVE-2001-1473 have on SSH users?
CVE-2001-1473 allows attackers to impersonate legitimate servers and potentially capture sensitive data transmitted during sessions.
Does CVE-2001-1473 affect all versions of SSH?
No, CVE-2001-1473 specifically affects the SSH-1 protocol and certain defined versions of SSH.
What security practices can mitigate CVE-2001-1473?
Implementing SSH-2 and avoiding the use of SSH-1 can significantly mitigate the risks associated with CVE-2001-1473.