CVE-2010-4478

Critical

Published: 06/12/2010(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol. This allows remote attackers to bypass the need for knowledge of the shared secret and successfully authenticate by sending crafted values in each round of the protocol.

Risk Assessment

Attackers can gain access to the system without knowledge of the shared secret, posing a serious security threat to the organization.

Recommendation

It is recommended to update OpenSSH to the latest version to eliminate this vulnerability and ensure proper validation of parameters in the J-PAKE protocol.

Original NVD description (English source)

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.