OpenSSH < 3.0.2 Multiple Vulnerabilities

High Nessus Plugin ID 10823


The SSH service running on the remote host has multiple vulnerabilities.


You are running a version of OpenSSH which is older than 3.0.2.
Versions prior than 3.0.2 have the following vulnerabilities :

- When the UseLogin feature is enabled, a local user could export environment variables, resulting in command execution as root. The UseLogin feature is disabled by default. (CVE-2001-0872)

- A local information disclosure vulnerability.
Only FreeBSD hosts are affected by this issue.


Upgrade to OpenSSH 3.0.2 or apply the patch for prior versions. (Available at:

See Also

Plugin Details

Severity: High

ID: 10823

File Name: openssh_uselogin_environment.nasl

Version: $Revision: 1.30 $

Type: remote

Family: Misc.

Published: 2001/12/10

Modified: 2016/11/02

Dependencies: 10267

Risk Information

Risk Factor: High


Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2001/12/03

Vulnerability Publication Date: 2001/12/03

Reference Information

CVE: CVE-2001-0872, CVE-2001-1029

BID: 3614

OSVDB: 688, 6073