CVE-2003-1562: Race Condition
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1562?
CVE-2003-1562 is considered a medium severity vulnerability due to its potential to enable password guessing attacks.
How do I fix CVE-2003-1562?
To fix CVE-2003-1562, upgrade OpenSSH to a version later than 3.6.1p2 that addresses this timing issue.
What types of authentication are affected by CVE-2003-1562?
CVE-2003-1562 affects systems using PAM keyboard-interactive authentication when PermitRootLogin is disabled.
Can CVE-2003-1562 lead to unauthorized access?
Yes, CVE-2003-1562 can lead to unauthorized access if attackers successfully exploit timing differences to guess passwords.
Which versions of OpenSSH are affected by CVE-2003-1562?
CVE-2003-1562 affects OpenSSH versions 3.6.1p2 and earlier.