Improper input validation in Cisco iOS
CVE-2002-1360
Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.061 (93.0th percentile) — read the EPSS interpretation.
Affected products
- Cisco Ios — versions 12.0s, 12.0st, 12.1e
- Fissh Ssh_client — versions 1.0a_for_windows
- Intersoft Securenetterm — versions 5.4.1
- Netcomposite Shellguard_ssh — versions 3.4.6
- Pragma_systems Secureshell — versions 2.0
- Putty — versions 0.48, 0.49, 0.53
- Winscp — versions 2.0.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)
- cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_CERT, third-party-advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_VULNWATCH)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2002-1360?
- CVE-2002-1360 is a vulnerability in Cisco iOS, classified under Improper Input Validation. Published 2002-12-23.
- Is CVE-2002-1360 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.