OpenSSH < 3.7.1 Multiple Vulnerabilities

Critical Nessus Plugin ID 11837


The remote SSH service is affected by various memory bugs.


According to its banner, the remote SSH server is running a version of OpenSSH older than 3.7.1. Such versions are vulnerable to a flaw in the buffer management functions that might allow an attacker to execute arbitrary commands on this host.

An exploit for this issue is rumored to exist.

Note that several distributions patched this hole without changing the version number of OpenSSH. Since Nessus solely relied on the banner of the remote SSH server to perform this check, this might be a false positive.

If you are running a RedHat host, make sure that the command :

rpm -q openssh-server

returns :

openssh-server-3.1p1-13 (RedHat 7.x) openssh-server-3.4p1-7 (RedHat 8.0) openssh-server-3.5p1-11 (RedHat 9)


Upgrade to OpenSSH 3.7.1 or later.

See Also

Plugin Details

Severity: Critical

ID: 11837

File Name: openssh_36.nasl

Version: $Revision: 1.41 $

Type: remote

Published: 2003/09/16

Modified: 2017/08/15

Dependencies: 12421, 12512, 10267, 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:ND/RC:C

Vulnerability Information

CPE: cpe:/a:openbsd:openssh

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2003/09/16

Reference Information

CVE: CVE-2003-0682, CVE-2003-0693, CVE-2003-0695, CVE-2004-2760

BID: 8628

OSVDB: 2557, 3456, 6601, 49386

RHSA: 2003:279

SuSE: SUSE-SA:2003:039

CWE: 16