CVE-2004-2760

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2004-2760

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2004-2760.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2004-2760

Published

2004-12-31T05:00:00Z

Modified

2024-11-20T23:54:09Z

Summary

[none]

Details

sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability.

References

Affected packages

Debian:11 / openssh

Package

Name: openssh
Purl: pkg:deb/debian/openssh?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:3.6p1-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / openssh

Package

Name: openssh
Purl: pkg:deb/debian/openssh?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:3.6p1-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / openssh

Package

Name: openssh
Purl: pkg:deb/debian/openssh?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:3.6p1-1

Ecosystem specific

{
    "urgency": "unimportant"
}