CVE-2005-2798 Information disclosure in n/a
OpenSSH exposes GSSAPI credentials to non-GSSAPI clients when delegation is enabled, allowing attackers to steal sensitive authentication tokens.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-2798?
CVE-2005-2798 is a medium-severity vulnerability in OpenSSH, published on 6 Sep 2005. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
Which versions are affected by CVE-2005-2798?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2005-2798?
Upgrade to a fixed version.
Is CVE-2005-2798 being exploited?
There is no known exploitation of CVE-2005-2798 in the wild and no public exploit code.
Other vulnerabilities in OpenSSH
Sources
Also known as DEBIAN-CVE-2005-2798, GHSA-qm2w-x4c4-rq55.