lsh daemon (lshd) does not properly return from certain functions in (1) read_line.c, (2) channel_commands.c, or (3) client_keyexchange.c when long input is provided, which could allow remote attackers to execute arbitrary code via a heap-based buffer overflow attack.

Secunia reports :

A vulnerability has been reported in LSH, which potentially can be exploited by malicious people to cause a DoS (Denial of Service).

Several security relevant problems have been discovered in lsh, the alternative secure shell v2 (SSH2) protocol server. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CAN-2003-0826     Bennett Todd discovered a heap buffer overflow in lshd     which could lead to the execution of arbitrary code.

  - CAN-2005-0814

    Niels Moller discovered a denial of service condition     in lshd.

The remote host is running a version of LSH that is vulnerable to a buffer overflow that allows an attacker to gain a shell on this host.

According to its banner, the version of LSH (a free replacement for SSH) is a version prior to 1.4.3 / 1.5.3.  It is, therefore, affected by a buffer overflow vulnerability due to improper handling of user input to the 'read_line.c', 'channel_commands.c', and 'client_keyexchange.c' source files that could allow an attacker to execute arbitrary code or cause a denial of service.

ID	Name	Product	Family	Severity
29874	FreeBSD : lsh -- multiple vulnerabilities (72cdf2ab-5b87-11dc-812d-0011098b2f36)	Nessus	FreeBSD Local Security Checks	high
18153	Debian DSA-717-1 : lsh-utils - buffer overflow, typo	Nessus	Debian Local Security Checks	high
1995	LSH < 1.5 lshd Daemon Remote Overflow	Nessus Network Monitor	SSH	high
11843	LSH Daemon < 1.4.3 / 1.5.3 lshd Remote Overflow	Nessus	Misc.	critical

Detections

Analytics

CVE-2003-0826

critical

Tenable Plugins

high

high

high

critical