CVE

Id
3385  
CVE No.
CVE-2001-0572  
Status
Candidate  
Description
The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands.  
Phase
Proposed (20010727)  
Votes
ACCEPT(3) Baker, Cole, Williams | MODIFY(1) Frech | NOOP(4) Christey, Foat, Wall, Ziese | REVIEWING(1) Bishop  
Comments
Frech> XF:ssh-plaintext-length-field(6783) | Christey> REDHAT:RHSA-2001:041 | (obsoletes REDHAT:RHSA-2001:033, according to Red Hat) | TURBO:TLSA2001021 | URL:http://www.turbolinux.com/pipermail/tl-security-announce/2001-May/000309.html | Christey> CISCO:20010627 Multiple SSH Vulnerabilities | http://www.cisco.com/warp/public/707/SSH-multiple-pub.html  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
14639 3385 CVE-2001-0572 BUGTRAQ:20010318 Passive Analysis of SSH (Secure Shell) Traffic  View
14640 3385 CVE-2001-0572 URL:http://archives.neohapsis.com/archives/bugtraq/2001-03/0225.html  View
14641 3385 CVE-2001-0572 CONECTIVA:CLA-2001:391  View
14642 3385 CVE-2001-0572 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000391  View
14643 3385 CVE-2001-0572 REDHAT:RHSA-2001:033  View
14644 3385 CVE-2001-0572 URL:http://www.redhat.com/support/errata/RHSA-2001-033.html  View
14645 3385 CVE-2001-0572 MANDRAKE:MDKSA-2001:033  View
14646 3385 CVE-2001-0572 URL:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-033.php3  View
14647 3385 CVE-2001-0572 CERT-VN:VU#596827  View

Related JVN