CVE-2005-2666 Information disclosure in n/a
Attackers with local access can read plaintext SSH known_hosts files to identify potential targets for further attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-2666?
CVE-2005-2666 is a low-severity vulnerability in OpenSSH, published on 23 Aug 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
Weakness: CWE-255
Which versions are affected by CVE-2005-2666?
It affects 1 product.
Linux distribution packages (24)
openssh Red Hat:enterprise_linux:4::as | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass Red Hat:enterprise_linux:4::as | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnome Red Hat:enterprise_linux:4::as | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-clients Red Hat:enterprise_linux:4::as | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-server Red Hat:enterprise_linux:4::as | All versions | 0:3.9p1-8.RHEL4.20 |
openssh Red Hat:enterprise_linux:4::desktop | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass Red Hat:enterprise_linux:4::desktop | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnome Red Hat:enterprise_linux:4::desktop | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-clients Red Hat:enterprise_linux:4::desktop | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-server Red Hat:enterprise_linux:4::desktop | All versions | 0:3.9p1-8.RHEL4.20 |
openssh Red Hat:enterprise_linux:4::es | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass Red Hat:enterprise_linux:4::es | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnome Red Hat:enterprise_linux:4::es | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-clients Red Hat:enterprise_linux:4::es | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-server Red Hat:enterprise_linux:4::es | All versions | 0:3.9p1-8.RHEL4.20 |
openssh Red Hat:enterprise_linux:4::ws | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass Red Hat:enterprise_linux:4::ws | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-askpass-gnome Red Hat:enterprise_linux:4::ws | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-clients Red Hat:enterprise_linux:4::ws | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:3.9p1-8.RHEL4.20 |
openssh-server Red Hat:enterprise_linux:4::ws | All versions | 0:3.9p1-8.RHEL4.20 |
Products include OpenSSH.
How do I fix CVE-2005-2666?
Upgrade to a fixed version.
Is CVE-2005-2666 being exploited?
There is no known exploitation of CVE-2005-2666 in the wild and no public exploit code.
Other vulnerabilities in OpenSSH
Sources
Also known as DEBIAN-CVE-2005-2666, GHSA-rfm3-rfv4-crj6, RHSA-2007:0257.