« Volver al listado

CVE-2003-0386

Estado: ModificadaAlta (7.5)—

OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openbsd — Openssh

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2003-0386",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-07-02T04:00:00.000",
  "references": [
    {
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.apple.com/mhonarc/security-announce/msg00038.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21129",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21262",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21724",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/22196",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/23680",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/978316",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0298.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0698.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/324016/2003-06-03/2003-06-09/0",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/7831",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9894",
      "source": "cve@mitre.org"
    },
    {
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/mhonarc/security-announce/msg00038.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/21129",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/21262",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/21724",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/22196",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/23680",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-174.htm",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/978316",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0298.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0698.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/324016/2003-06-03/2003-06-09/0",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/7831",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9894",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass \"from=\" and \"user@host\" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address."
    },
    {
      "lang": "es",
      "value": "OpenSSH 3.6.1 y anteriores, cuando se restringe el acceso de máquinas por direcciones IP numéricas, y con VerifyReverseMapping desactivado, permite a atacantes remotos evitar restricciones de acceso \"from=\" y \"usuario@maquina\" conectandose a una máquina de un sistema cuyo nombre DNS inverso contiene la dirección IP numérica."
    }
  ],
  "lastModified": "2026-06-16T22:02:06.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openbsd:openssh:3.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8176879B-1875-4AC9-B15A-2ABCFCD04F88"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}