AttachmateWRQ Reflection for Secure IT Server SFTP Format String

Medium Nessus Plugin ID 20902


The remote SSH server is affected by a format string vulnerability.


The remote host is running AttachmateWRQ Reflection for Secure IT Server / F-Secure SSH Server, a commercial SSH server.

According to its banner, the installed version of this software contains a format string vulnerability in its sftp subsystem. A remote, authenticated attacker may be able to execute arbitrary code on the affected host subject to his privileges or crash the server itself.


Either upgrade as described in the vendor advisory above or edit the software's configuration to disable the SFTP subsystem.

See Also

Plugin Details

Severity: Medium

ID: 20902

File Name: wrq_reflection_sftp_format_string.nasl

Version: $Revision: 1.13 $

Type: remote

Family: Misc.

Published: 2006/02/14

Modified: 2012/12/10

Dependencies: 10267

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:F/RL:W/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2006/02/13

Reference Information

CVE: CVE-2006-0705

BID: 16625

OSVDB: 23172

CERT: 419241