CVE-2003-0786
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege...
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
Exploit likelihood
What each source reports
NVD Score used
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
CVE-2003-0786- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
CVE-2003-0786- Updated
- 2026-11-02
EUVDEUVD-2003-0777 No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
EUVD-2003-0777- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cm7j-g432-hx2j No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege...
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
GHSA-cm7j-g432-hx2j- Updated
- 2026-11-02
OSV No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
CVE-2003-0786- Updated
- 2026-11-02
OSVDEBIAN-CVE-2003-0786 No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
DEBIAN-CVE-2003-0786- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0786 is a high vulnerability (CVSS 10.0) in Openbsd Openssh, published September 25, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.56%, the 89th percentile. Fixed in openssh 1:3.7.1p2.
References
openssh.com/txt/sshpam.adv
securityfocus.com/bid/8677
lists.grok.org.uk/pipermail/full-disclosure/2003-September/010812.html
kb.cert.org/vuls/id/602204
nvd.nist.gov/vuln/detail/CVE-2003-0786
github.com/advisories/GHSA-cm7j-g432-hx2j
security-tracker.debian.org/tracker/CVE-2003-0786