CVE-2005-2666: openbsd openssh Credentials Management Errors
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2005-2666 is a low (CVSS 1.2) Credentials Management Errors vulnerability in openbsd openssh. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.1% of scored vulnerabilities.
Timeline
- 23-08-2005PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.18% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- openssh< 0:3.9p1-8.RHEL4.20
- openssh-askpass< 0:3.9p1-8.RHEL4.20
- openssh-askpass-gnome< 0:3.9p1-8.RHEL4.20
- openssh-clients< 0:3.9p1-8.RHEL4.20
- openssh-debuginfo< 0:3.9p1-8.RHEL4.20
Debian1 product
- openssh< 1:4.0p1-1
Openbsd1 product
- openssh3.0 | 3.0.1 | 3.0.1p1 | 3.0.2 | 3.0.2p1 | 3.0p1 | 3.1 | 3.1p1 | 3.2 | 3.2.2p1 | 3.2.3p1 | 3.3 | 3.3p1 | 3.4 | 3.4p1 | 3.5 | 3.5p1 | 3.6 | 3.6.1 | 3.6.1p1 | 3.6.1p2 | 3.7 | 3.7.1 | 3.7.1p2 | 3.8 | 3.8.1 | 3.8.1p1 | 3.9 | 3.9.1 | 3.9.1p1
3 vendors · 8 products
References
18 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10201VDB EntrySignatureX Refsource OVAL
- www.eweek.com/article2/0%2C1759%2C1815795%2C00.aspX Refsource MISC
