PT-2007-3035 · Netsieben · Netsieben Ssh Library

Published 2007-03-24 · Updated 2024-02-14 · CVE-2007-1654

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NetSieben SSH Library (ne7ssh) versions prior to 1.2.1

Description: The issue is related to a buffer overflow in the Ne7sshSftp::addOpenHandle function, which can be triggered by user-assisted remote SFTP servers. This can cause a denial of service (crash) or possibly allow the execution of arbitrary code via multiple file transfers. The vulnerability is specifically related to multiple open file handles in SFTP put and get operations.

Recommendations: For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the number of open file handles in SFTP operations to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1654

Affected Products

Netsieben Ssh Library

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-1654 · Security Note
• http://osvdb.org/43555 · Note
• http://netsieben.com/files/CHANGELOG · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33504 · Note