Description
Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 3
- DSA-382-2 ssh - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-382-3 ssh - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-383 ssh-krb5 - possible remote vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030917 [OpenPKG-SA-2003.040] OpenPKG Security Advisory (openssh) mailing-list
- DSA-383 vendor-advisory
- http://www.openssh.com/txt/buffer.adv
- RHSA-2003:280 vendor-advisory
- http://marc.info/?l=openbsd-security-announce&m=106375582924840
- CLA-2003:741 vendor-advisory
- 2003-0033 vendor-advisory
- DSA-382 vendor-advisory
- MDKSA-2003:090 vendor-advisory
- oval:org.mitre.oval:def:452 vdb-entry signature
- RHSA-2003:279 vendor-advisory
- 20030917 [slackware-security] OpenSSH updated again (SSA:2003-260-01) mailing-list