Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2002-1359 — Improper Input Validation in Cisco IOS

CWE-20 — Improper Input Validation9 documents6 sources
Severity
10.0CRITICALNVD
EPSS
87.0%
top 0.56%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Cisco IOSFissh SSH ClientIntersoft Securenetterm+5 more
Timeline
PublishedDec 23
Latest updateApr 30

Description

Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages8 packages

▶NVDcisco/ios8 versions+7
▶NVDputty/putty0.48, 0.49, 0.53+2
▶NVDwinscp/winscp2.0.0
▶NVDfissh/ssh_client1.0a_for_windows

🔴Vulnerability Details

1
GHSA
GHSA-fxj2-7cf3-5hcm: Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service↗2022-04-30
▶

💥Exploits & PoCs

4
Exploit-DB
PuTTy.exe 0.53 - Remote Buffer Overflow (Metasploit)↗2010-06-15
▶
Exploit-DB
PuTTy.exe 0.53 - Validation Remote Buffer Overflow (Metasploit)↗2006-05-15
▶
Exploit-DB
HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (1)↗2003-02-12
▶
Metasploit
PuTTY Buffer Overflow↗
▶

📋Vendor Advisories

3
Cisco
SSH Malformed Packet Vulnerabilities↗2002-12-19
▶
Debian
CVE-2002-1359: openssh - Multiple SSH2 servers and clients do not properly handle large packets or large ...↗2002
▶
Cisco
SSH Malformed Packet Vulnerabilities↗
▶