CVE-2014-2653

Published: Mar 27, 2014Modified: May 28, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

Affected (7)

Products: Openbsd: Openssh

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Up to 6.6
Openbsd Openssh	Version 6.0
Openbsd Openssh	Version 6.1
Openbsd Openssh	Version 6.2
Openbsd Openssh	Version 6.3
Openbsd Openssh	Version 6.4
Openbsd Openssh	Version 6.5

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (32)

http://advisories.mageia.org/MGASA-2014-0166.html

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=141576985122836&w=2

Source: cve@mitre.org

http://openwall.com/lists/oss-security/2014/03/26/7

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2014-1552.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-0425.html

Source: cve@mitre.org

http://secunia.com/advisories/59855

Source: cve@mitre.org

http://www.debian.org/security/2014/dsa-2894

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2014:068

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:095

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/66459

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2164-1

Source: cve@mitre.org

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513

Source: cve@mitre.org

Exploit

http://advisories.mageia.org/MGASA-2014-0166.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=141576985122836&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2014/03/26/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-1552.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-0425.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/59855

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-2894

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2014:068

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2015:095

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/66459

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2164-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.