Login Request a demo
Unscored severity · published Nov 25, 2002
CVE-2002-1644
SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the…
–
CVSS
0.4%
EPSS
No
On KEV
Description
SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the process group of the parent process, which allows attackers to gain certain privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Ssh2 · Ssh
2.0.13; 2.1; 2.2; 2.3; 2.4; 2.5; +9 more · source: NVD
Affected product
SS
Ssh2
Ssh
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1644
Patch
http://www.kb.cert.org/vuls/id/740619
Patch
http://www.securityfocus.com/bid/6247
Patch
http://www.ssh.com/company/newsroom/article/286/
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/10710
More from Ssh2
–
CVE-2002-1715
SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then…
–
CVE-2002-1645
Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL
–
CVE-2001-0364
SSH Communications Security sshd 2.4 for Windows allows remote attackers to create a denial of service via a large number of simultaneous connections
–
CVE-2000-0217
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program
–
CVE-1999-1231
ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password…