Vulnerability Description
Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Ios | 12.0s |
| Fissh | Ssh Client | 1.0a_for_windows |
| Intersoft | Securenetterm | 5.4.1 |
| Netcomposite | Shellguard Ssh | 3.4.6 |
| Pragma Systems | Secureshell | 2.0 |
| Putty | Putty | 0.48 |
| Winscp | Winscp | 2.0.0 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0110.htmlVendor Advisory
- http://securitytracker.com/id?1005812
- http://securitytracker.com/id?1005813
- http://www.cert.org/advisories/CA-2002-36.htmlThird Party AdvisoryUS Government Resource
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0110.htmlVendor Advisory
- http://securitytracker.com/id?1005812
- http://securitytracker.com/id?1005813
- http://www.cert.org/advisories/CA-2002-36.htmlThird Party AdvisoryUS Government Resource
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2002-1360?
CVE-2002-1360 is a vulnerability with a CVSS score of 10.0 (HIGH). Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denia...
How severe is CVE-2002-1360?
CVE-2002-1360 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2002-1360?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Ios, Fissh Ssh Client, Intersoft Securenetterm, Netcomposite Shellguard Ssh, Pragma Systems Secureshell.