CVE-2003-0786

Published: Nov 17, 2003Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.

Affected (2)

Products: Openbsd: Openssh

Openbsd

1 product

Openssh

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Version 3.7.1
Openbsd Openssh	Version 3.7.1p1

References (12)

http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010812.html

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/602204

Source: cve@mitre.org

US Government Resource

http://www.openssh.com/txt/sshpam.adv

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/338616

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/338617

Source: cve@mitre.org

http://www.securityfocus.com/bid/8677

Source: cve@mitre.org

http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/010812.html