CVE-2003-1120: Race Condition
Race condition in SSH Tectia Server 4.0.3 and 4.0.4 for Unix, when the password change plugin (ssh-passwd-plugin) is enabled, allows local users to obtain the server's private key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the password change plugin (ssh-passwd-plugin) in SSH Tectia Server on affected Unix systems to prevent local users from obtaining the server's private key.
SSH Tectia Server ssh-passwd-plugin = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1120?
CVE-2003-1120 is classified as a medium severity vulnerability due to the potential exposure of sensitive private key information.
How do I fix CVE-2003-1120?
To resolve CVE-2003-1120, disable the password change plugin in SSH Tectia Server or upgrade to a patched version.
What are the affected versions for CVE-2003-1120?
CVE-2003-1120 affects SSH Tectia Server versions 4.0.3 and 4.0.4.
Who can exploit CVE-2003-1120?
Local users on the system can exploit CVE-2003-1120 to gain unauthorized access to the server's private key.
What are the potential impacts of CVE-2003-1120?
Successful exploitation of CVE-2003-1120 could allow attackers to obtain the SSH server's private key, compromising the server's security.