SecureCRT SSH1 protocol identifier string buffer overflow
| securecrt-ssh1-identifier-bo (9650) |  High Risk |
Description:
VanDyke Software's SecureCRT is vulnerable to a buffer overflow in the section of code that handles responses from SSH1 servers. By responding with a long server identifier string when a SecureCRT client establishes a connection, a remote attacker in control of an SSH server could overflow a buffer and execute code on the vulnerable system.
Consequences:
Gain Access
Remedy:
Contact VanDyke Software for upgrade or patch information. See References.
References:
- BugTraq Mailing List, Mon Jul 22 2002 - 22:09:44 CDT: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta.
- BugTraq Mailing List, Mon Jul 29 2002 - 11:35:47 CDT: Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta.
- BugTraq Mailing List, Tue Jul 23 2002 - 16:14:01 CDT: Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta.
- BugTraq Mailing List, Wed Jul 24 2002 - 08:30:34 CDT: Re: Arbitrary Code Execution Vulnerability in VanDyke SecureCRT 3.4 & 4.0 beta.
- VanDyke Software Web site: Download - SecureCRT.
- BID-12122: Van Dyke SecureCRT Remote Denial of Service Vulnerability
- BID-5287: SecureCRT SSH1 Identifier String Buffer Overflow Vulnerability
- BID-529: NT IIS MDAC RDS Vulnerability
- CVE-2002-1059: Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.
- OSVDB ID: 4991: SecureCRT SSH-1 Protocol Version String Remote Overflow
- SECTRACK ID: 1004838: (Vendor Issues Fix) Re: VanDyke Softwares SecureCRT SSH Client Buffer Overflow Lets Malicious Remote Servers Execute Arbitrary Code on the Client
Platforms Affected:
- VanDyke SecureCRT 3.4
- VanDyke SecureCRT 4.0 beta
Reported:
Jul 23, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this