Name: CVE-2014-1692: Improper Restriction of Operations within the Bounds of a Memory Buffer
Creator: Rapid7
Published: 2014-01-29T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2014-1692, CWE-119, CVSS 7.3, EPSS 0.12538

The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.

CVSS Details

CVSS 3.1 Base Score: 7.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Hpsim	—	Upgrade to the latest version of HP Systems Insight Manager	Oct 13, 2015	Jan 29, 2014
Hpux	—	Update Secure_Shell.SECURE_SHELL to the latest versionUpdate Secure_Shell.SECSH-CMN to the latest version	Aug 11, 2017	Jan 29, 2014
Openbsd Openssh	—	Upgrade to the latest version of OpenSSH	Jan 31, 2014	Jan 29, 2014

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence