PT-2008-1785 · Pragma · Fortressssh

Luigi Auriemma · Published 2008-01-08 · Updated 2022-10-24 · CVE-2008-0132

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Pragma FortressSSH versions 5.0 Build 4 Revision 293 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically connection slot exhaustion, by flooding the system with SSH connections containing long data objects. This can be achieved through various means, such as providing a long list of keys or using a long username.

Recommendations For Pragma FortressSSH versions 5.0 Build 4 Revision 293 and earlier, consider implementing rate limiting on incoming SSH connections to mitigate the risk of connection slot exhaustion. Additionally, as a temporary workaround, restrict the maximum allowed length for usernames and keys to prevent abuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2008-0132

Affected Products

Fortressssh

References · 7

• 🔥 https://exploit-db.com/exploits/30989 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0132 · Security Note
• http://securityfocus.com/bid/27141 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39354 · Note
• http://marc.info/?l=bugtraq&m=119947184730448&w=2 · Note
• http://aluigi.org/poc/pragmassh.zip · Note
• http://aluigi.altervista.org/adv/pragmassh-adv.txt · Note