CVE-2014-1692

ALTO 7.3CVE-2014-1692 · Published 29/01/2014 · updated 17/06/2026

Em resumo

CVE-2014-1692 é uma vulnerabilidade ALTO (CVSS 7.3) que afeta openssh (openbsd).
Chance de exploração nos próximos 30 dias (EPSS): 4.7%, maior que 91.8% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
openssh openbsd	`≤ 6.4`	No fix yet

Description

The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.

References

marc.info · Third Party Advisory
marc.info · Third Party Advisory
openwall.com/lists/oss-security/2014/01/29/10 · Mailing List
openwall.com/lists/oss-security/2014/01/29/2 · Mailing List
osvdb.org/102611 · Broken Link
secunia.com/advisories/60184 · Third Party Advisory
www-01.ibm.com/support/docview.wss · Third Party Advisory
openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff
openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c · Vendor Advisory
securityfocus.com/bid/65230 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/90819 · Third Party Advisory

Mais vulnerabilidades de openssh

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openssh

openbsd

≤ 6.4

No fix yet

Description

Mais vulnerabilidades de openssh

Ver tudo →