CVE-2003-0386: High severity OpenBSD OpenSSH vulnerability
OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable VerifyReverseMapping in the OpenSSH server configuration (sshd_config) so reverse DNS is validated; this prevents bypassing of from= and user@host address restrictions when reverse mapping is otherwise disabled.
OpenSSH VerifyReverseMapping = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0386?
CVE-2003-0386 is considered a moderate severity vulnerability due to its potential to allow unauthorized access to systems.
How do I fix CVE-2003-0386?
To fix CVE-2003-0386, upgrade OpenSSH to version 3.6.2 or later, which addresses this vulnerability.
What does CVE-2003-0386 affect?
CVE-2003-0386 affects OpenSSH version 3.6.1 and earlier when reverse DNS mapping is disabled.
Can CVE-2003-0386 be exploited remotely?
Yes, CVE-2003-0386 can be exploited remotely by attackers who can manipulate reverse DNS entries.
What is the primary risk associated with CVE-2003-0386?
The primary risk of CVE-2003-0386 is that it allows remote attackers to bypass specific host access restrictions.