CVE-2002-0639: Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code dur...

Security readout for executives and security teams

This is a legacy OpenSSH server flaw. Systems running OpenSSH 2.9.9 through 3.3 could allow remote code execution if challenge-response authentication is enabled and backed by SKEY or BSD_AUTH. The business risk is serious where old SSH services remain exposed, but current exploitation is not established in the provided sources. Exposure is most likely on legacy Unix or Linux systems still running OpenSSH 2.9.9 through 3.3 with ChallengeResponseAuthentication configured for SKEY or BSD_AUTH. Modern supported OpenSSH deployments are unlikely to match this configuration, but forgotten appliances, old servers, and unsupported images should be checked. Prioritize if any legacy SSH service is exposed to untrusted networks. Remote code execution in sshd can lead to host compromise. If inventory confirms no OpenSSH 2.9.9 through 3.3 with SKEY or BSD_AUTH, this should be documented and closed as not applicable. Mitigation focus: Identify and retire OpenSSH 2.9.9 through 3.3 installations.; Follow relevant vendor advisories for supported replacement packages.; Disable affected challenge-response paths if vendor guidance recommends it..

Prepared

Jun 30, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.