CVE-2003-0693 Memory corruption in n/a

Critical 10.0 Published 17 Sep 2003 Updated 8 Aug 2024

Remote attackers can execute arbitrary code via a heap corruption vulnerability in OpenSSH's buffer management, affecting unauthenticated users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2003-0693?

CVE-2003-0693 is a critical memory corruption vulnerability in OpenSSH, published on 17 Sep 2003. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695.

Which versions are affected by CVE-2003-0693?

It affects 1 product.

Products include OpenSSH.

How do I fix CVE-2003-0693?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2003-0693 being exploited?

There is no known exploitation of CVE-2003-0693 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as DEBIAN-CVE-2003-0693, DSA-382-1, GHSA-2264-54r3-3rjm.