CVE-2001-1475: High severity SSH ssh vulnerability
Published Jan 18, 2001
·Updated
SSH before 2.0, when using RC4 and password authentication, allows remote attackers to replay messages until a new server key (VK) is generated.
Affected Software
8 affected components
SSH ssh=1.2.31
SSH ssh=1.2.24
SSH ssh=1.2.25
SSH ssh=1.2.30
SSH ssh=1.2.26
SSH ssh=1.2.27
SSH ssh=1.2.28
SSH ssh=1.2.29
Remediation
Patch Available
Event History
Jan 18, 2001
CVE Published
05:00 AM
Apr 21, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1475?
CVE-2001-1475 is considered a medium severity vulnerability due to the potential for remote message replay attacks.
2
How do I fix CVE-2001-1475?
To fix CVE-2001-1475, upgrade all affected SSH versions to a secure version that does not use RC4 for password authentication.
3
What versions of SSH are affected by CVE-2001-1475?
CVE-2001-1475 affects SSH versions 1.2.24 through 1.2.31.
4
What is the exploit type associated with CVE-2001-1475?
CVE-2001-1475 is associated with a replay attack that can compromise authentication protocols.
5
What attack vector is used in CVE-2001-1475?
The attack vector for CVE-2001-1475 involves remote attackers re-sending previously captured authentication messages.