CVE-2005-2666: Low severity OpenBSD OpenSSH vulnerability
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the knownhosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2666?
CVE-2005-2666 is considered a moderate severity vulnerability due to the exposure of sensitive information in plaintext.
How do I fix CVE-2005-2666?
To mitigate CVE-2005-2666, upgrade to OpenSSH version 4.0 or later which addresses this vulnerability.
What does CVE-2005-2666 exploit?
CVE-2005-2666 exploits the storage of hostnames, IP addresses, and keys in plaintext in the known_hosts file of OpenSSH.
Which versions of OpenSSH are affected by CVE-2005-2666?
CVE-2005-2666 affects OpenSSH versions prior to 4.0.
What are the potential risks associated with CVE-2005-2666?
The risks associated with CVE-2005-2666 include unauthorized access, as attackers can easily identify and target additional systems using the exposed information.