CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 5742 | CVE-2002-1358 | Candidate | Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite. | Modified (20090302) | ACCEPT(1) Baker | MODIFY(1) Frech | NOOP(2) Cole, Cox | REVIEWING(1) Wall | Frech> XF:ssh-transport-empty-lists-bo(10869) | View |
| 1721 | CVE-2000-0143 | Candidate | The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP. | Interim (20001011) | ACCEPT(3) Blake, Cole, LeBlanc | MODIFY(1) Frech | NOOP(2) Baker, Bishop | REJECT(1) Levy | REVIEWING(1) Christey | Frech> XF:ssh-redirect-tcp-connection | CHANGE> [Cole changed vote from REVIEWING to ACCEPT] | Christey> Examine the thread at | http://marc.theaimsgroup.com/?l=bugtraq&m=95055978131077&w=2 | to ensure that this problem is being characterized | appropriately. | Levy> SSH is working as designed. The fact that some of its interactions | are not forseen by some is not a vulnerability. | View |
| 3385 | CVE-2001-0572 | Candidate | The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands. | Proposed (20010727) | ACCEPT(3) Baker, Cole, Williams | MODIFY(1) Frech | NOOP(4) Christey, Foat, Wall, Ziese | REVIEWING(1) Bishop | Frech> XF:ssh-plaintext-length-field(6783) | Christey> REDHAT:RHSA-2001:041 | (obsoletes REDHAT:RHSA-2001:033, according to Red Hat) | TURBO:TLSA2001021 | URL:http://www.turbolinux.com/pipermail/tl-security-announce/2001-May/000309.html | Christey> CISCO:20010627 Multiple SSH Vulnerabilities | http://www.cisco.com/warp/public/707/SSH-multiple-pub.html | View |
| 3288 | CVE-2001-0471 | Candidate | SSH daemon version 1 (aka SSHD-1 or SSH-1) 1.2.30 and earlier does not log repeated login attempts, which could allow remote attackers to compromise accounts without detection via a brute force attack. | Proposed (20010524) | MODIFY(1) Frech | NOOP(2) Cole, Wall | REVIEWING(2) Oliver, Ziese | Frech> XF:ssh-daemon-failed-login(6071) | Oliver> Not clear how much of this is a vulnerability and how much a | problem with site policy. | View |
| 5105 | CVE-2002-0715 | Candidate | Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user"s proxy login and password. | Modified (20050601) | ACCEPT(4) Armstrong, Baker, Cole, Cox | MODIFY(1) Frech | NOOP(3) Christey, Foat, Wall | Frech> XF:squid-auth-header-forwarding(9478) | Christey> REDHAT:RHSA-2002:051 | URL:http://rhn.redhat.com/errata/RHSA-2002-051.html | Christey> CALDERA:CSSA-2003-SCO.9 | View |
Page 78 of 20943, showing 5 records out of 104715 total, starting on record 386, ending on 390
