Description
Sysax Multi Server versions prior to 5.55 contains a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.
Problem types
CWE-121 Stack-based Buffer Overflow
Product status
* before 5.55
Credits
Craig Freyman
References
raw.githubusercontent.com/...ndows/ssh/sysax_ssh_username.rb
www.exploit-db.com/exploits/18535
www.exploit-db.com/exploits/18557
web.archive.org/...ax-multi-server-ssh-username-exploit.html
advisories.checkpoint.com/...s/public/2012/cpai-23-sepc.html
www.sysax.com/
www.vulncheck.com/...lti-server-ssh-username-buffer-overflow
