NVD

Id
15732  
Name
CVE-2010-4478  
Description
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-12-06  
Modified Date
2016-12-07  
Seq
2010-4478  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
89173 15732 CVE-2010-4478 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673  View
89174 15732 CVE-2010-4478 oval:org.mitre.oval:def:12338  View
89175 15732 CVE-2010-4478 http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf  View
89176 15732 CVE-2010-4478 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c#rev1.5  View
89177 15732 CVE-2010-4478 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c.diff?r1=1.4;r2=1.5;f=h  View
89178 15732 CVE-2010-4478 https://bugzilla.redhat.com/show_bug.cgi?id=659297  View
89179 15732 CVE-2010-4478 https://github.com/seb-m/jpake  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36979 JVNDB-2010-002759 OpenSSH における共有秘密鍵の認証要求を回避される脆弱性 OpenSSH は、J-PAKE が有効な際、J-PAKE プロトコル内のパブリックパラメータを適切に検証しないため、共有秘密鍵の認証要求を回避される脆弱性が存在します。 CVE-2010-4478 47058 CVE-2010-4478 15732 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002759.html 2010-12-06 2011-02-21 View