CVE-2002-0639

Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication.

• CWE-190

• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txtBroken Link
• http://archives.neohapsis.com/archives/bugtraq/2002-06/0335.htmlBroken Link
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502Broken Link
• http://marc.info/?l=bugtraq&m=102514371522793&w=2Exploit, Mailing List
• http://marc.info/?l=bugtraq&m=102514631524575&w=2Exploit, Mailing List
• http://marc.info/?l=bugtraq&m=102521542826833&w=2Exploit, Mailing List
• http://www.cert.org/advisories/CA-2002-18.htmlThird Party Advisory, US Government Resource
• http://www.debian.org/security/2002/dsa-134Broken Link
• http://www.iss.net/security_center/static/9169.phpBroken Link
• http://www.kb.cert.org/vuls/id/369347Third Party Advisory, US Government Resource
• http://www.linuxsecurity.com/advisories/other_advisory-2177.htmlBroken Link
• http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:040Broken Link
• http://www.osvdb.org/6245Broken Link
• http://www.securityfocus.com/bid/5093Broken Link, Third Party Advisory, VDB Entry
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195Broken Link
• https://twitter.com/RooneyMcNibNug/status/1152332585349111810Broken Link
• https://web.archive.org/web/20080622172542/www.iss.net/threats/advise123.htmlThird Party Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-030.0.txtBroken Link
• http://archives.neohapsis.com/archives/bugtraq/2002-06/0335.htmlBroken Link
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000502Broken Link
• http://marc.info/?l=bugtraq&m=102514371522793&w=2Exploit, Mailing List
• http://marc.info/?l=bugtraq&m=102514631524575&w=2Exploit, Mailing List
• http://marc.info/?l=bugtraq&m=102521542826833&w=2Exploit, Mailing List
• http://www.cert.org/advisories/CA-2002-18.htmlThird Party Advisory, US Government Resource
• http://www.debian.org/security/2002/dsa-134Broken Link
• http://www.iss.net/security_center/static/9169.phpBroken Link
• http://www.kb.cert.org/vuls/id/369347Third Party Advisory, US Government Resource
• http://www.linuxsecurity.com/advisories/other_advisory-2177.htmlBroken Link
• http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:040Broken Link
• http://www.osvdb.org/6245Broken Link
• http://www.securityfocus.com/bid/5093Broken Link, Third Party Advisory, VDB Entry
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0206-195Broken Link
• https://twitter.com/RooneyMcNibNug/status/1152332585349111810Broken Link
• https://web.archive.org/web/20080622172542/www.iss.net/threats/advise123.htmlThird Party Advisory

Published

Jul 3, 2002

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2002-0632Vulnerability in SGI BDS (Bulk Data Service) BDSPro 2.4 and …
• CVE-2002-0633Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2002-0634Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2002-0635Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2002-0637InterScan VirusWall 3.52 build 1462 allows remote attackers …
• CVE-2002-0638setpwnam.c in the util-linux package, as included in Red Hat…
• CVE-2002-0640Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may all…
• CVE-2002-0641Buffer overflow in bulk insert procedure of Microsoft SQL Se…
• CVE-2002-0642The registry key containing the SQL Server service account i…
• CVE-2002-0643The installation of Microsoft Data Engine 1.0 (MSDE 1.0), an…
• CVE-2002-0644Buffer overflow in several Database Consistency Checkers (DB…
• CVE-2002-0645SQL injection vulnerability in stored procedures for Microso…