A remote overflow exists in SSH2. The SSH2 software fails to handle strings with null characters in the length field, resulting in a buffer overflow. By sending a specially-crafted packet with a string field containing null characters during SSH key exchange and initialization, a remote attacker could overflow a buffer and crash or execute arbitrary code on the system with privileges of the SSH process, resulting in a loss of confidentiality, integrity or availability.

Currently, there are no known workarounds or upgrades to correct this issue. However, Cisco, Pragma Systems, PuTTY and SecureNetTerm have released a patch to address this vulnerability.

• ISS X-Force ID: 10871
• CVE ID: 2002-1360 (see also: NVD)
• CERT VU: 389665
• Bugtraq ID: 6410
• CERT: CA-2002-36
• Vendor Specific Advisory URL: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
  http://www.cisco.com/warp/public/707/ssh-packet-suite-vuln.shtml
  http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2003-01-003&viewMode=view [ Auth Req'd ]
• Other Advisory URL: http://www.rapid7.com/advisories/R7-0009.txt
• CIAC Advisory: n-028

Unknown or Incomplete