CVE-2002-0640
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute...
CVE-2002-0640 is a high vulnerability (CVSS 10.0) in Openbsd Openssh, published July 3, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.2%, the 98th percentile. Fixed in openssh 1:3.4.
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
CVE-2002-0640- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
CVE-2002-0640- Updated
- 2026-11-02
EUVDEUVD-2002-0634 No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
EUVD-2002-0634- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9hw-p2pq-q4p7 No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute...
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
GHSA-q9hw-p2pq-q4p7- Updated
- 2026-11-02
OSV No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
CVE-2002-0640- Updated
- 2026-11-02
OSVDEBIAN-CVE-2002-0640 No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
DEBIAN-CVE-2002-0640- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenSSH 3.x - Challenge-Response Buffer Overflow (1) | 2002-06-24 |
| Exploit-DB | OpenSSH 3.x - Challenge-Response Buffer Overflow (2) | 2002-06-24 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
debian.org/security/2002/dsa-134
redhat.com/support/errata/RHSA-2002-127.html
marc.info?l=bugtraq&m=102514371522793&w=2
novell.com/linux/security/advisories/2002_024_openssh_txt.html
osvdb.org/839
Show 14 moreShow less
cert.org/advisories/CA-2002-18.html
securityfocus.com/bid/5093
linuxsecurity.com/advisories/other_advisory-2177.html
kb.cert.org/vuls/id/369347
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000502
www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195
mandrakesoft.com/security/advisories?name=MDKSA-2002:040
openwall.com/lists/oss-security/2024/07/01/3
nvd.nist.gov/vuln/detail/CVE-2002-0640
github.com/advisories/GHSA-q9hw-p2pq-q4p7
security-tracker.debian.org/tracker/CVE-2002-0640