Description
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:3.4 | — |
| Debian 13 | openssh | 1:3.4 | — |
| Debian 12 | openssh | 1:3.4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- OpenSSH 3.x - Challenge-Response Buffer Overflow (1) EDB-21578 · remote · Jun 24, 2002 · verified
- OpenSSH 3.x - Challenge-Response Buffer Overflow (2) EDB-21579 · remote · Jun 24, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- DSA-134 vendor-advisory
- RHSA-2002:127 vendor-advisory
- 20020626 OpenSSH Security Advisory (adv.iss) mailing-list
- SuSE-SA:2002:024 vendor-advisory
- 20020628 Sun statement on the OpenSSH Remote Challenge Vulnerability mailing-list
- 839 vdb-entry
- CA-2002-18 third-party-advisory
- 20020627 How to reproduce OpenSSH Overflow. mailing-list
- RHSA-2002:131 vendor-advisory
- 5093 vdb-entry
- ESA-20020702-016 vendor-advisory
- VU#369347 third-party-advisory
- CLA-2002:502 vendor-advisory
- HPSBUX0206-195 vendor-advisory
- MDKSA-2002:040 vendor-advisory
- 20020626 Revised OpenSSH Security Advisory (adv.iss) mailing-list
- [oss-security] 20240701 CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems mailing-list