Home  >  CVE-1999-1085
CVE Details for CVE: CVE-1999-1085
Summary
SSH 1.2.25, 1.2.23, and other versions, when used in in CBC (Cipher Block Chaining) or CFB (Cipher Feedback 64 bits) modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, aka the "SSH insertion attack."
Timestamps
Last major update 18-10-2016 - 02:01
Published 12-06-1998 - 04:00
Last modified 18-10-2016 - 02:01
References
Vulnerable Configurations
  • cpe:2.3:a:ssh:secure_shell:1.2.23:*:*:*:*:*:*:*
    cpe:2.3:a:ssh:secure_shell:1.2.23:*:*:*:*:*:*:*
  • cpe:2.3:a:ssh:secure_shell:1.2.25:*:*:*:*:*:*:*
    cpe:2.3:a:ssh:secure_shell:1.2.25:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
CWE
NVD-CWE-Other
CVSS
Base
5.0
Impact
2.9
Exploitability
10.0
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
CVSS3
None
VIA4 references
cvss-vector via4
AV:N/AC:L/Au:N/C:N/I:P/A:N
refmap via4
bugtraq
  • 19980612 CORE-SDI-04: SSH insertion attack
  • 19980703 UPDATE: SSH insertion attack
cert-vn VU#13877
cisco 20010627 Multiple SSH Vulnerabilities
xf ssh-insert(1126)