UpHeron
All vulnerabilities

Servers and applications

CVE-2003-1562

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

Severity
High 7.6
Published
31 Dec 2003
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Exploit chance
5.6% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Race condition (CWE-362)
Attack
Over the network · Only under certain conditions · No login needed
Attacker can
Read data · Change data · Take it down
CVSS vector
AV:N/AC:H/Au:N/C:C/I:C/A:C
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSHServers and applications · cpe:a:openbsd:openssh
  • Version 3.6.1p2
  • Version 3.6.1p1
  • Version 3.6.1
  • Version 3.6
All 45 release lines
  • Version 1.2
  • Version 1.2.1
  • Version 1.2.2
  • Version 1.2.3
  • Version 1.2.27
  • Version 1.3
  • Version 1.5
  • Version 1.5.7
  • Version 1.5.8
  • Version 2
  • Version 2.1
  • Version 2.1.1
  • Version 2.2
  • Version 2.3
  • Version 2.3.1
  • Version 2.5
  • Version 2.5.1
  • Version 2.5.2
  • Version 2.9
  • Version 2.9p1
  • Version 2.9p2
  • Version 2.9.9
  • Version 2.9.9p2
  • Version 3.0
  • Version 3.0p1
  • Version 3.0.1
  • Version 3.0.1p1
  • Version 3.0.2
  • Version 3.0.2p1
  • Version 3.1
  • Version 3.1p1
  • Version 3.2
  • Version 3.2.2
  • Version 3.2.2p1
  • Version 3.2.3p1
  • Version 3.3
  • Version 3.3p1
  • Version 3.4
  • Version 3.4p1
  • Version 3.5
  • Version 3.5p1
  • Version 3.6
  • Version 3.6.1
  • Version 3.6.1p1
  • Version 3.6.1p2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2003-1562
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2003-1562