CVE-2002-0640
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute...
CVE-2002-0640 is a high vulnerability (CVSS 10.0) in Openbsd Openssh, published July 3, 2002. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 28.2%, the 98th percentile. Fixed in openssh 1:3.4.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 28.2%EPSS, 98th percentile
- Exploitation
- None known2 public exploits
- Fixed in
1:3.4openssh +2 more
Description
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
Exploit likelihood
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenSSH 3.x - Challenge-Response Buffer Overflow (1) | 2002-06-24 |
| Exploit-DB | OpenSSH 3.x - Challenge-Response Buffer Overflow (2) | 2002-06-24 |
What each source reports
NVD Score used
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
CVE-2002-0640- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
CVE-2002-0640- Updated
- 2026-11-02
EUVDEUVD-2002-0634No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
EUVD-2002-0634- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9hw-p2pq-q4p7No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute...
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
GHSA-q9hw-p2pq-q4p7- Updated
- 2026-11-02
OSVNo score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
CVE-2002-0640- Updated
- 2026-11-02
OSVDEBIAN-CVE-2002-0640No score
Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt).
- Record
DEBIAN-CVE-2002-0640- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
debian.org/security/2002/dsa-134
redhat.com/support/errata/RHSA-2002-127.html
marc.info?l=bugtraq&m=102514371522793&w=2
novell.com/linux/security/advisories/2002_024_openssh_txt.html
osvdb.org/839
Show 14 moreShow less
cert.org/advisories/CA-2002-18.html
securityfocus.com/bid/5093
linuxsecurity.com/advisories/other_advisory-2177.html
kb.cert.org/vuls/id/369347
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000502
www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195
mandrakesoft.com/security/advisories?name=MDKSA-2002:040
openwall.com/lists/oss-security/2024/07/01/3
nvd.nist.gov/vuln/detail/CVE-2002-0640
github.com/advisories/GHSA-q9hw-p2pq-q4p7
security-tracker.debian.org/tracker/CVE-2002-0640