CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2001-1585
https://notcve.org/view.php?id=CVE-2001-1585
SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to bypass authentication as other users by supplying a public key from that user's authorized_keys file. • http://archives.neohapsis.com/archives/bugtraq/2001-02/0159.html http://online.securityfocus.com/bid/2356 http://www.openbsd.org/advisories/ssh_bypass.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/6084 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2001-0872
https://notcve.org/view.php?id=CVE-2001-0872
OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges. OpenSSH 3.0.1 y anteriores con UseLogin activado no limpia variables de entorno críticas como LD_PRELOAD, lo que permite a usuario locales ganar privilegios de root. • ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2001-042.1.txt http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000446 http://frontal2.mandriva.com/security/advisories?name=MDKSA-2001:092 http://lists.suse.com/archives/suse-security-announce/2001-Dec/0001.html http://marc.info/?l=bugtraq&m=100749779131514&w=2 http://marc.info/?l=openssh-unix-dev&m=100747128105913&w=2 http://www.ciac.org/ciac/bulletins/m-026.shtml http://www.debian.org/security/2001/dsa- •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2001-0816
https://notcve.org/view.php?id=CVE-2001-0816
OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands. • http://archives.neohapsis.com/archives/bugtraq/2001-09/0153.html http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000431 http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-034-01 http://www.osvdb.org/5536 http://www.redhat.com/support/errata/RHSA-2001-154.html https://exchange.xforce.ibmcloud.com/vulnerabilities/7634 •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2001-1380
https://notcve.org/view.php?id=CVE-2001-1380
OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000431 http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-034-01 http://marc.info/?l=bugtraq&m=100154541809940&w=2 http://rhn.redhat.com/errata/RHSA-2001-114.html http://www.ciac.org/ciac/bulletins/m-010.shtml http://www.kb.cert.org/vuls/id/905795 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-081.php http://www.osvdb.org/642 http://www.securityfocus.com/bid/3369 https: •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2001-1382
https://notcve.org/view.php?id=CVE-2001-1382
The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used. • http://www.openwall.com/Owl/CHANGES-stable.shtml http://www.osvdb.org/5408 •