CVE-2003-0786
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege...
CVE-2003-0786 is a high vulnerability (CVSS 10.0) in Openbsd Openssh, published September 25, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.56%, the 89th percentile. Fixed in openssh 1:3.7.1p2.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 3.56%EPSS, 89th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:3.7.1p2openssh +2 more
Description
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
CVE-2003-0786- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
CVE-2003-0786- Updated
- 2026-11-02
EUVDEUVD-2003-0777No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
EUVD-2003-0777- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cm7j-g432-hx2jNo score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege...
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
GHSA-cm7j-g432-hx2j- Updated
- 2026-11-02
OSVNo score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
CVE-2003-0786- Updated
- 2026-11-02
OSVDEBIAN-CVE-2003-0786No score
The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges.
- Record
DEBIAN-CVE-2003-0786- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openssh.com/txt/sshpam.adv
securityfocus.com/bid/8677
lists.grok.org.uk/pipermail/full-disclosure/2003-September/010812.html
kb.cert.org/vuls/id/602204
nvd.nist.gov/vuln/detail/CVE-2003-0786
github.com/advisories/GHSA-cm7j-g432-hx2j
security-tracker.debian.org/tracker/CVE-2003-0786