National Vulnerability Database (CVE-2002-1357)

National Cyber-Alert System Vulnerability Summary: CVE-2002-1357
Orirignal release date: 2002-12-23 Source: US-CERT/NIST ### Overview Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite. ### Impact CVSS Severity: 8 (High) Range: remote Authentication: design Impact Type: avail,sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: Security Focus Name: bid 6405 Hyperlink: http://online.securityfocus.com/bid/6405 External Source: CERT Name: CERT Advisory CA-2002-36 Multiple Vulnerabilities in SSH Implementations Hyperlink: http://www.cert.org/advisories/CA-2002-36.html External Source: VULNWATCH Name: 20021216 R7-0009: Vulnerabilities in SSH2 Implementations from Multiple Vendors Hyperlink: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0110.html External Source: CERT-VN Name: VU#389665 Hyperlink: http://www.kb.cert.org/vuls/id/389665 ### Vulnerable Software and Vendor Shellguard SSH (NetComposite) SecureNetTerm (InterSoft) IOS (Cisco) SSH Client (FiSSH) SecureShell (Pragma Systems) PuTTY (Simon Tatham) WinSCP (WinSCP) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1357