SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to bypass authentication as other users by supplying a public key from that user's authorized_keys file.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is running OpenSSH 2.3.1. This version is vulnerable to a flaw that allows any attacker who can obtain the public key of a valid SSH user to log into this host without any authentication.

Note: NNM has solely relied on the banner of the SSH client to perform this check. Any backported patches or workarounds such as recompiling or edited configurations are not observable through the banner. 

According to its banner, the remote host is running OpenSSH 2.3.1.

This version is vulnerable to a flaw that allows any attacker who can obtain the public key of a valid SSH user to log into this host without any authentication.

ID	Name	Product	Family	Type	Severity
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	Remote	critical
1985	OpenSSH < 2.3.2 SSHv2 Public Key Authentication Bypass	Nessus Network Monitor	SSH		critical
10608	OpenSSH 2.3.1 SSHv2 Public Key Authentication Bypass	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2001-1585

critical

Tenable Plugins

critical

critical

high