The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges.

The version of SunSSH running on the remote host has an information disclosure vulnerability.  A design flaw in the SSH specification could allow a man-in-the-middle attacker to recover up to 32 bits of plaintext from an SSH-protected connection in the standard configuration.  An attacker could exploit this to gain access to sensitive information.

Note that this version of SunSSH is also prone to several additional issues but Nessus did not test for them.

The remote host is portable OpenSSH 3.7p1 or 3.7.1p1.
Versions older than 3.7.1p2 are vulnerable to a flaws that handle PAM authentication and may allow an attacker to gain a shell on this host.  

According to its banner, the remote host appears to be running OpenSSH 3.7p1 or 3.7.1p1. These versions are vulnerable to a flaw in the way they handle PAM authentication when PrivilegeSeparation is disabled.

Successful exploitation of this issue may allow an attacker to gain a shell on the remote host using a null password.

ID	Name	Product	Family	Severity
55992	SunSSH < 1.1.1 / 1.3 CBC Plaintext Disclosure	Nessus	Misc.	critical
1996	Portable OpenSSH < 3.7.1p2 Multiple PAM Vulnerabilities	Nessus Network Monitor	SSH	high
11848	OpenSSH < 3.7.1p2 Multiple Remote Vulnerabilities	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2003-0787

critical

Tenable Plugins

critical

high

high