Vulnerability Details CVE-2003-1562
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.013
EPSS Ranking 78.6%
CVSS Severity
CVSS v2 Score 7.6
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747
- http://www.securityfocus.com/archive/1/320153
- http://www.securityfocus.com/archive/1/320302
- http://www.securityfocus.com/archive/1/320440
- http://www.securityfocus.com/bid/7482
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747
- http://www.securityfocus.com/archive/1/320153
- http://www.securityfocus.com/archive/1/320302
- http://www.securityfocus.com/archive/1/320440
- http://www.securityfocus.com/bid/7482
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
Products affected by CVE-2003-1562
-
cpe:2.3:a:openbsd:openssh:1.2
-
cpe:2.3:a:openbsd:openssh:1.2.1
-
cpe:2.3:a:openbsd:openssh:1.2.2
-
cpe:2.3:a:openbsd:openssh:1.2.27
-
cpe:2.3:a:openbsd:openssh:1.2.3
-
cpe:2.3:a:openbsd:openssh:1.3
-
cpe:2.3:a:openbsd:openssh:1.5
-
cpe:2.3:a:openbsd:openssh:1.5.7
-
cpe:2.3:a:openbsd:openssh:1.5.8
-
cpe:2.3:a:openbsd:openssh:2
-
cpe:2.3:a:openbsd:openssh:2.1
-
cpe:2.3:a:openbsd:openssh:2.1.1
-
cpe:2.3:a:openbsd:openssh:2.2
-
cpe:2.3:a:openbsd:openssh:2.3
-
cpe:2.3:a:openbsd:openssh:2.3.1
-
cpe:2.3:a:openbsd:openssh:2.5
-
cpe:2.3:a:openbsd:openssh:2.5.1
-
cpe:2.3:a:openbsd:openssh:2.5.2
-
cpe:2.3:a:openbsd:openssh:2.9
-
cpe:2.3:a:openbsd:openssh:2.9.9
-
cpe:2.3:a:openbsd:openssh:2.9.9p2
-
cpe:2.3:a:openbsd:openssh:2.9p1
-
cpe:2.3:a:openbsd:openssh:2.9p2
-
cpe:2.3:a:openbsd:openssh:3.0
-
cpe:2.3:a:openbsd:openssh:3.0.1
-
cpe:2.3:a:openbsd:openssh:3.0.1p1
-
cpe:2.3:a:openbsd:openssh:3.0.2
-
cpe:2.3:a:openbsd:openssh:3.0.2p1
-
cpe:2.3:a:openbsd:openssh:3.0p1
-
cpe:2.3:a:openbsd:openssh:3.1
-
cpe:2.3:a:openbsd:openssh:3.1p1
-
cpe:2.3:a:openbsd:openssh:3.2
-
cpe:2.3:a:openbsd:openssh:3.2.2
-
cpe:2.3:a:openbsd:openssh:3.2.2p1
-
cpe:2.3:a:openbsd:openssh:3.2.3p1
-
cpe:2.3:a:openbsd:openssh:3.3
-
cpe:2.3:a:openbsd:openssh:3.3p1
-
cpe:2.3:a:openbsd:openssh:3.4
-
cpe:2.3:a:openbsd:openssh:3.4p1
-
cpe:2.3:a:openbsd:openssh:3.5
-
cpe:2.3:a:openbsd:openssh:3.5p1
-
cpe:2.3:a:openbsd:openssh:3.6
-
cpe:2.3:a:openbsd:openssh:3.6.1
-
cpe:2.3:a:openbsd:openssh:3.6.1p1
-
cpe:2.3:a:openbsd:openssh:3.6.1p2