Unscored severity · published May 13, 1999
CVE-1999-1029
SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the…
–
CVSS
1.6%
EPSS
No
On KEV
Description
SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Ssh2 · Ssh
2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-1999-1029
CVE.org
https://www.cve.org/CVERecord?id=CVE-1999-1029
marc.info
http://marc.info/?l=bugtraq&m=92663402004280&w=2
Patch
http://www.securityfocus.com/bid/277
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/2193
More from Ssh2
–
CVE-2002-1715
SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then…
–
CVE-2002-1645
Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL
–
CVE-2002-1644
SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the…
–
CVE-2001-0364
SSH Communications Security sshd 2.4 for Windows allows remote attackers to create a denial of service via a large number of simultaneous connections
–
CVE-2000-0217
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program