National Vulnerability Database (CVE-2005-2797)

National Cyber-Alert System Vulnerability Summary: CVE-2005-2797
Orirignal release date: 2005-09-06 Source: US-CERT/NIST ### Overview OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding (&quot;-D&quot; option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality. ### Impact CVSS Severity: 3.3 (Low) Range: remote Authentication: config Impact Type: int ### Reference to Advisories, Solutions, and Tools External Source: MLIST Name: [openssh-unix-announce] 20050901 Announce: OpenSSH 4.2 released Hyperlink: http://www.mindrot.org/pipermail/openssh-unix-announce/2005-September/000083.html External Source: SECUNIA Name: 16686 Hyperlink: http://secunia.com/advisories/16686 External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: SCO Name: SCOSA-2005.53 Hyperlink: ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.53/SCOSA-2005.53.txt External Source: SECUNIA Name: 18010 Hyperlink: http://secunia.com/advisories/18010 External Source: BID Name: 14727 Hyperlink: http://www.securityfocus.com/bid/14727 External Source: SCO Name: SCOSA-2006.11 Hyperlink: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.11/SCOSA-2006.11.txt External Source: SECUNIA Name: 19243 Hyperlink: http://secunia.com/advisories/19243 ### Vulnerable Software and Vendor OpenSSH (OpenBSD) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2797