VanDyke SecureCRT contains a remote overflow that may allow an attacker to execute arbitrary code. The issue is due to the SSH1 server not properly sanitizing the version string sent by the remote client. If a client sends a specially crafted version string, they may be able to overflow the buffer and execute arbitrary code with the same privileges as the server runs under.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Vendor Verified
Solution
Upgrade to version 3.2.2, 3.3.4, 3.4.8, 4.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
SirDrinkalot.rm-f.net -
