CVE-2002-0639
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute...
CVE-2002-0639 is a critical vulnerability (CVSS 9.8) in Openbsd Openssh, published July 3, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.3%, the 97th percentile. Fixed in openssh 1:3.4.
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
- Record
CVE-2002-0639- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
- Record
CVE-2002-0639- Updated
- 2026-11-02
EUVDEUVD-2002-0633 No score
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
- Record
EUVD-2002-0633- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3cc-85g2-jg55 No score
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute...
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
- Record
GHSA-p3cc-85g2-jg55- Updated
- 2026-11-02
OSV
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
- Record
CVE-2002-0639- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2002-0639
Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.
- Record
DEBIAN-CVE-2002-0639- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2002/dsa-134
iss.net/security_center/static/9169.php
archives.neohapsis.com/archives/bugtraq/2002-06/0335.html
marc.info?l=bugtraq&m=102514371522793&w=2
osvdb.org/6245
cert.org/advisories/CA-2002-18.html
Show 13 moreShow less
securityfocus.com/bid/5093
linuxsecurity.com/advisories/other_advisory-2177.html
kb.cert.org/vuls/id/369347
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000502
www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195
mandrakesoft.com/security/advisories?name=MDKSA-2002:040
web.archive.org/web/20080622172542/www.iss.net/threats/advise123.html
twitter.com/RooneyMcNibNug/status/1152332585349111810
nvd.nist.gov/vuln/detail/CVE-2002-0639
github.com/advisories/GHSA-p3cc-85g2-jg55
security-tracker.debian.org/tracker/CVE-2002-0639