CVE-2002-0639: Integer Overflow
Published Jul 3, 2002
·Updated
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSDAUTH authentication.
Affected Software
27 affected components
OpenBSD OpenSSH>=2.9.9<=3.3
OpenBSD OpenSSH=3.1
OpenBSD OpenSSH=3.0.2p1
OpenBSD OpenSSH=2.1.1
OpenBSD OpenSSH=3.2.3p1
OpenBSD OpenSSH=3.1p1
OpenBSD OpenSSH=2.5.1
OpenBSD OpenSSH=3.0
OpenBSD OpenSSH=2.2
OpenBSD OpenSSH=3.2
OpenBSD OpenSSH=1.2.3
OpenBSD OpenSSH=3.0.1p1
OpenBSD OpenSSH=2.1
OpenBSD OpenSSH=3.3
OpenBSD OpenSSH=3.2.2p1
OpenBSD OpenSSH=3.0.2
OpenBSD OpenSSH=3.0.1
OpenBSD OpenSSH=2.9.9
OpenBSD OpenSSH=1.2.2
OpenBSD OpenSSH=2.9p1
OpenBSD OpenSSH=2.9
OpenBSD OpenSSH=2.5.2
OpenBSD OpenSSH=2.3
OpenBSD OpenSSH=2.5
OpenBSD OpenSSH=3.0p1
OpenBSD OpenSSH=3.3p1
OpenBSD OpenSSH=2.9p2
Event History
Jul 3, 2002
CVE Published
via NVD·04:00 AM
Apr 2, 2003
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-0639?
CVE-2002-0639 is considered a critical vulnerability as it allows remote attackers to execute arbitrary code.
2
How do I fix CVE-2002-0639?
To fix CVE-2002-0639, upgrade your OpenSSH version to 3.4 or later.
3
What software is affected by CVE-2002-0639?
CVE-2002-0639 affects OpenSSH versions from 2.9.9 to 3.3, including several specific versions listed in the advisory.
4
What type of attack does CVE-2002-0639 facilitate?
CVE-2002-0639 facilitates remote code execution during challenge response authentication.
5
Are there specific authentication methods impacted by CVE-2002-0639?
Yes, CVE-2002-0639 affects OpenSSH when using SKEY or BSD_AUTH authentication methods.