Description
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One EDB-21314 · remote · Mar 7, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20020311 TSLSA-2002-0039 - openssh mailing-list
- 730 vdb-entry
- 4241 vdb-entry
- 20020308 [OpenPKG-SA-2002.002] OpenPKG Security Advisory (openssh) mailing-list
- HPSBTL0203-029 vendor-advisory
- DSA-119 vendor-advisory
- SuSE-SA:2002:009 vendor-advisory
- CSSA-2002-012.0 vendor-advisory
- 20020310 OpenSSH 2.9.9p2 packages for Immunix 6.2 with latest fix mailing-list
- ESA-20020307-007 vendor-advisory
- CLA-2002:467 vendor-advisory
- 20020307 OpenSSH Security Advisory (adv.channelalloc) mailing-list
- 20020307 [PINE-CERT-20020301] OpenSSH off-by-one mailing-list
- MDKSA-2002:019 vendor-advisory
- RHSA-2002:043 vendor-advisory
- openssh-channel-error(8383) vdb-entry
- http://www.openbsd.org/advisories/ssh_channelalloc.txt
- 20020328 OpenSSH channel_lookup() off by one exploit mailing-list
- 20020307 [VulnWatch] [PINE-CERT-20020301] OpenSSH off-by-one mailing-list