OpenSSH Challenge-Response Buffer Overflow Vulnerabilities

Joe Testa <jtesta@rapid7.com> has provided information on how a server segmentation fault may be produced with the use of a modified, malicious SSH client. Details are available in the referenced Bugtraq message post.

Christophe Devine <devine@iie.cnam.fr> has published a proof-of-concept exploit (as a patch to the OpenSSH client).

GOBBLES has also released proof-of-concept code.

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.


 

Privacy Statement
Copyright 2010, SecurityFocus