What’s Vulnerable › Vulnerabilities

CVE-2002-0083

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2002-03-15 · updated 2026-06-16
• Weakness: CWE-193

Description

Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.

Affected products

• Conectiva Linux: 5.0, 5.1, 6.0, 7.0, ecommerce, graficas
• Engardelinux Secure Linux: 1.0.1
• Immunix: 7.0
• Mandrakesoft Mandrake Linux: 7.1, 7.2, 8.0, 8.1
• Mandrakesoft Mandrake Linux Corporate Server: 1.0.1
• Mandrakesoft Mandrake Single Network Firewall: 7.2
• OpenSSH: from 2.0 before 3.1 — fixed in 3.1
• Openpkg: 1.0
• RedHat Linux: 7.0, 7.1, 7.2
• Suse Linux: 6.4, 6.4-alpha, 7.0, 7.0-alpha, 7.1, 7.1-alpha (+2)
• Trustix Secure Linux: 1.1, 1.2, 1.5

How to fix

Upgrade to a fixed version: OpenSSH 3.1. Check the vendor advisory for mitigations.

References

• http://archives.neohapsis.com/archives/bugtraq/2002-03/0108.html
• http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0060.html
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000467
• http://marc.info/?l=bugtraq&m=101552065005254&w=2
• http://marc.info/?l=bugtraq&m=101553908201861&w=2
• http://marc.info/?l=bugtraq&m=101561384821761&w=2
• http://marc.info/?l=bugtraq&m=101586991827622&w=2
• http://online.securityfocus.com/advisories/3960

Get alerted when CVE-2002-0083 or the next vulnerability affects your stack