Multiple Vendor SSH2 Implementation Buffer Overflow Vulnerabilities

Multiple vendor SSH2 implementations are reported to be prone to buffer overflows. These buffer overflows are alleged to be exploitable prior to authentication.

These conditions were discovered during tests of the initialization, key exchange, and negotiation phases (KEX, KEXINIT) of a SSH2 transaction between client and server. These issues are known to affect various client and server implementations of the protocol.

Successful exploitation will enable remote attackers to cause execution of code in the security context of the specific server and client implementations.

Further details about this vulnerability are currently unknown. This BID will be updated as more information becomes available. This vulnerability was originally described in BugTraq ID 6397.


Privacy Statement
Copyright 2010, SecurityFocus