PT-2008-5937 · Goodtech · Goodtech Ssh

R0Ut3R · Published 2008-10-23 · Updated 2018-10-11 · CVE-2008-4726

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GoodTech SSH version 6.4

Description The issue is a stack-based buffer overflow in the SFTP subsystem. This can be exploited by remote authenticated users who send a long string to certain parameters, including the open (also known as SSH FXP OPEN), unlink, and opendir parameters, allowing them to execute arbitrary code.

Recommendations For GoodTech SSH version 6.4, consider restricting access to the SFTP subsystem until a patch is available. As a temporary workaround, avoid using long strings in the open, unlink, and opendir parameters to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-4726

Affected Products

Goodtech Ssh

References · 8

• 🔥 http://securityfocus.com/bid/31879 · Exploit
• 🔥 https://exploit-db.com/exploits/6804 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4726 · Security Note
• http://secunia.com/advisories/32375 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2895 · Note
• http://securityreason.com/securityalert/4498 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46038 · Note
• http://securityfocus.com/archive/1/497745/100/0/threaded · Note