PT-2008-1752 · Georgia Softworks · Georgia Softworks Ssh2 Server

Publicado 2008-01-08 · Atualizado 2018-10-15 · CVE-2008-0097

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Georgia SoftWorks SSH2 Server (GSW SSHD) versions 7.01.0003 and earlier

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in the username field. This can be demonstrated by a certain LoginPassword message.

Recommendations For versions 7.01.0003 and earlier, consider disabling the log function temporarily until a patch is available to prevent exploitation. Restrict access to the log function to minimize the risk of arbitrary code execution. Avoid using format string specifiers in the username field until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-0097

Produtos afetados

Georgia Softworks Ssh2 Server

Referências · 5

• http://aluigi.altervista.org/adv/gswsshit-adv.txt · Nota
• http://securityfocus.com/archive/1/485725/100/0/threaded · Nota
• http://secunia.com/advisories/28307 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-0097 · Nota de Segurança
• http://securityreason.com/securityalert/3517 · Nota