Read the docs
TI-2000-00573 Aliases CVE-2000-0575GHSA-fwxc-qvhc-7v9m

SSH 1.2.27 with Kerberos authentication support stores Kerberos tickets in a file which…

Priority LOW 33Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

SSH 1.2.27 with Kerberos authentication support stores Kerberos tickets in a file which is created in the current directory of the user who is logging in, which could allow remote attackers to sniff the ticket cache if the home directory is installed on NFS.

Why it matters now

EPSS 0.00839 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ssh:ssh:1.2.27:*:*:*:*:*:*:*1.2.27VulnerableSSH
  • cpe:2.3:a:ssh:ssh:1.2.27:*:*:*:*:*:*:* Versions 1.2.27 Vulnerable ·SSH

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2000-0575
  2. 2026-10-03 Alias added: GHSA-fwxc-qvhc-7v9m

References

Other 1

  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2001-00144 CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute… CVSS 2.0HIGH 10.0
  • TI-1999-00245 A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker… CVSS 2.0HIGH 10.0
  • TI-1999-00013 Stolen credentials from SSH clients via ssh-agent program, allowing other local users to… CVSS 3.1HIGH 8.4
  • TI-2001-00557 The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have… CVSS 2.0HIGH 7.5
  • TI-2001-01425 The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay… CVSS 2.0HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences