CVE-2003-1562: openbsd openssh Race Condition

Vulnerability summary

CVE-2003-1562 is a high (CVSS 7.6) Race Condition vulnerability in openbsd openssh. EPSS estimates a 5.57% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities.

Timeline

1. 04-08-2008
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.