CVE-2003-1562
Estado: ModificadaAlta (7.6)—
sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
- Puntuación base: 7.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 5.57%
- Percentil entre todas las CVEs puntuadas: 93
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-362
Referencias
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747
- http://www.securityfocus.com/archive/1/320153
- http://www.securityfocus.com/archive/1/320302
- http://www.securityfocus.com/archive/1/320440
- http://www.securityfocus.com/bid/7482
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747
- http://www.securityfocus.com/archive/1/320153
- http://www.securityfocus.com/archive/1/320302
- http://www.securityfocus.com/archive/1/320440
- http://www.securityfocus.com/bid/7482
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
JSON original (NVD)
Mostrar
{
"id": "CVE-2003-1562",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "HIGH",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": true,
"exploitabilityScore": 4.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2003-12-31T05:00:00.000",
"references": [
{
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/320153",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/320302",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/320440",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/7482",
"source": "cve@mitre.org"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
"source": "cve@mitre.org"
},
{
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/320153",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/320302",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/320440",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/7482",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190."
}
],
"lastModified": "2026-06-16T22:04:39.700",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "316C8534-9CE3-456C-A04E-5D2B789FBE31"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7BEB67BB-A442-46C2-8BC1-BBEB009AC532"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6E307F1-C765-409C-835C-133026A5179C"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA997F5E-29FE-454A-9006-001D732CD4B1"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.2.27:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "114134F3-BDFD-465D-8317-82F9D6EFA5A7"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAB55300-F90D-45D3-88BC-5ADCEC366264"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3EC5611-31B5-4253-B99A-E81C202768A0"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.5.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43060323-1B51-45B4-BEB9-0E472896D8EA"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:1.5.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5441C616-D127-42D9-88AA-0FC9AA16EB03"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE60A415-91E3-4819-A252-E86A32EC3018"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EED5E506-9D2B-4CAF-8455-B9BE7696E49C"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE7CB94E-0479-4939-86F6-0B4BEDE2E739"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78135400-BA1A-42AA-BE17-5588442BCF11"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78F2EDC0-3189-4523-882B-9188C852F793"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDEF5203-9D6B-4431-BF0D-C81B1E250AEC"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2991C07-5486-4590-A74E-46A379DD3339"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EB9BE06-0A36-4853-ADF4-9C1A1854278A"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FC57F38-6545-497B-B6DA-FCAF51755988"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC30FD61-10DA-4C9B-BCE8-AD75DCEB40BC"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.9.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC1DF4CE-E71C-4C10-9F82-B9ECDC94933F"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.9.9p2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80C55B73-497D-4A22-9230-A4160BF97344"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.9p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0238F009-4BBA-4E6B-9E2A-6045BA9BBE9C"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:2.9p2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B235167-9554-4431-88C5-9472DD36FCDE"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "580008AC-2667-4708-8F7E-D70416A460EE"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E05D8E86-EC01-4589-B372-4DEB7845C81F"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.0.1p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "764AD252-CA2F-4A87-BCAA-7747E8C410E0"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFFAA075-4277-4FD8-8A5A-867EEE1BA2F4"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.0.2p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "269BB9F7-55E5-4CB3-8429-C37C7132799F"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.0p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6E6F639-31A0-4026-B6D4-51BA79FB1D20"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0211BCE3-0DED-40BA-8A21-1A97B91F71C7"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.1p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4EE9E4B-CABC-4EA2-9075-CC23CEB1B0A3"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AD7BB30-AC79-4153-852C-1053DCF4DE53"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F48519C6-0C28-49A5-94C7-EF3AA88E2667"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.2.2p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E188C66-C8F1-4C13-AAFF-7C83B2A884B8"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.2.3p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9039BE91-AF0A-41E7-8F9F-15375890E120"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08BCB2EA-DF9D-4853-805B-29FA6274E2B7"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.3p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F93417F-2498-4576-9F5D-B59F77D39669"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF3AB42C-B614-4746-99AD-E94140D91BF3"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.4p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "458167E5-9BC2-40BE-AC8A-9761A4F19494"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3FB9B4C7-4235-4388-8E5D-E72ECCC37A7E"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.5p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86ACA0ED-A3D0-48A7-B06F-13709AD23B55"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FEB9262-D05E-4610-9C79-3EDE44AC7C0B"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8176879B-1875-4AC9-B15A-2ABCFCD04F88"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.6.1p1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAA26A12-F96A-4025-BBCA-72B7A3B1E60C"
},
{
"criteria": "cpe:2.3:a:openbsd:openssh:3.6.1p2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A02751E9-2D38-4495-9572-8D84D71D4773"
}
],
"operator": "OR"
}
]
}
],
"vendorComments": [
{
"comment": "The risks associated with fixing this bug are greater than the low severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 2.1 and 3 which is in maintenance mode.",
"lastModified": "2008-08-11T00:00:00",
"organization": "Red Hat"
}
],
"sourceIdentifier": "cve@mitre.org"
}