Description
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:3.4 | — |
| Debian 13 | openssh | 1:3.4 | — |
| Debian 12 | openssh | 1:3.4 | — |
References
- DSA-134 vendor-advisory
- openssh-challenge-response-bo(9169) vdb-entry
- 20020626 [OpenPKG-SA-2002.005] OpenPKG Security Advisory (openssh) mailing-list
- 20020626 OpenSSH Security Advisory (adv.iss) mailing-list
- 6245 vdb-entry
- CA-2002-18 third-party-advisory
- 20020627 How to reproduce OpenSSH Overflow. mailing-list
- 5093 vdb-entry
- ESA-20020702-016 vendor-advisory
- VU#369347 third-party-advisory
- CLA-2002:502 vendor-advisory
- HPSBUX0206-195 vendor-advisory
- MDKSA-2002:040 vendor-advisory
- 20020626 Revised OpenSSH Security Advisory (adv.iss) mailing-list
- 20020626 OpenSSH Remote Challenge Vulnerability third-party-advisory
- https://twitter.com/RooneyMcNibNug/status/1152332585349111810